Skip to content

chore(deps): bump the cargo group in /src-tauri with 17 updates - #478

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/src-tauri/cargo-46fe1f5777
Closed

chore(deps): bump the cargo group in /src-tauri with 17 updates#478
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/src-tauri/cargo-46fe1f5777

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the cargo group in /src-tauri with 17 updates:

Package From To
tauri-plugin-opener 2.5.3 2.5.4
tauri-plugin-dialog 2.6.0 2.7.2
tauri-plugin-single-instance 2.4.0 2.4.3
serde 1.0.228 1.0.229
serde_json 1.0.149 1.0.151
tauri-plugin-prevent-default 2.1.4 5.0.0
notify 6.1.1 8.2.0
regex 1.12.3 1.13.1
reqwest 0.12.28 0.13.2
zip 2.4.2 4.6.1
opener 0.7.2 0.8.5
chrono 0.4.44 0.4.45
base64 0.22.1 0.23.0
winreg 0.52.0 0.55.0
webview2-com 0.38.2 0.39.1
windows 0.61.3 0.62.2
tauri-build 2.5.5 2.6.3

Updates tauri-plugin-opener from 2.5.3 to 2.5.4

Release notes

Sourced from tauri-plugin-opener's releases.

opener-js v2.5.4

[2.5.4]

npm warn Unknown user config "always-auth". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-opener@2.5.4
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 3.1kB dist-js/index.cjs
npm notice 2.0kB dist-js/index.d.ts
npm notice 3.1kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 730B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-opener
npm notice version: 2.5.4
npm notice filename: tauri-apps-plugin-opener-2.5.4.tgz
npm notice package size: 3.5 kB
npm notice unpacked size: 14.1 kB
npm notice shasum: b37883e4d36125b8c5a0c74f683395958a65bd7d
npm notice integrity: sha512-1HnPkb+AmgO29[...]aUJtT57lfO9CQ==
npm notice total files: 7
npm notice
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=1429011743
+ @tauri-apps/plugin-opener@2.5.4

opener v2.5.4

[2.5.4]

... (truncated)

Commits

Updates tauri-plugin-dialog from 2.6.0 to 2.7.2

Release notes

Sourced from tauri-plugin-dialog's releases.

dialog-js v2.7.2

[2.7.2]

  • 40ae0a7f (#3491 by @​Legend-Master) Use com.google.android.material.dialog.MaterialAlertDialogBuilder instead of AlertDialog so the dialog follows the app's theme
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-dialog@2.7.2
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.5kB README.md
npm notice 6.9kB dist-js/index.cjs
npm notice 14.6kB dist-js/index.d.ts
npm notice 6.8kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 657B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-dialog
npm notice version: 2.7.2
npm notice filename: tauri-apps-plugin-dialog-2.7.2.tgz
npm notice package size: 6.7 kB
npm notice unpacked size: 33.3 kB
npm notice shasum: 322d0874bae71fed6d10c76168fa0f7f4d5dd875
npm notice integrity: sha512-pX0IGm1I3I6wc[...]0jQGQNyOvLrsg==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2194858458
+ @tauri-apps/plugin-dialog@2.7.2

dialog v2.7.2

[2.7.2]

  • 40ae0a7f (#3491 by @​Legend-Master) Use com.google.android.material.dialog.MaterialAlertDialogBuilder instead of AlertDialog so the dialog follows the app's theme

... (truncated)

Commits

Updates tauri-plugin-single-instance from 2.4.0 to 2.4.3

Release notes

Sourced from tauri-plugin-single-instance's releases.

barcode-scanner-js v2.4.3

[2.4.3]

npm warn Unknown user config "always-auth". This will stop working in the next major version of npm.
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-barcode-scanner@2.4.3
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.3kB README.md
npm notice 2.2kB dist-js/index.cjs
npm notice 1.6kB dist-js/index.d.ts
npm notice 2.1kB dist-js/index.js
npm notice 754B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-barcode-scanner
npm notice version: 2.4.3
npm notice filename: tauri-apps-plugin-barcode-scanner-2.4.3.tgz
npm notice package size: 3.4 kB
npm notice unpacked size: 10.9 kB
npm notice shasum: a401570d2698692fa6878bd816122ac3f8d7142d
npm notice integrity: sha512-y5jIRTFqCeUnc[...]cJWhCfKu6qOQA==
npm notice total files: 6
npm notice
npm notice Security Notice: Classic tokens have been revoked. Granular tokens are now limited to 90 days and require 2FA by default. Update your CI/CD workflows to avoid disruption. Learn more https://gh.io/all-npm-classic-tokens-revoked
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=804717978
+ @tauri-apps/plugin-barcode-scanner@2.4.3

barcode-scanner v2.4.3

[2.4.3]

... (truncated)

Commits
  • 06124af publish new versions (#2972)
  • 060219e chore(deps): update dependency @​rollup/plugin-typescript to v12.3.0 (#3067)
  • c7e9766 chore(deps): update tauri monorepo (v2) (#3058)
  • d4a8ce9 chore(deps): update rust crate tokio-tungstenite to 0.28 (#3016)
  • cdc7eec chore(deps): update dependency @​rollup/plugin-typescript to v12.2.0 (#3066)
  • 6314b00 chore: temp delete updater changefile
  • fb4c8ae chore(deps): update dependency typescript-eslint to v8.46.2 (#3060)
  • fccc1cf chore(deps): update eslint monorepo to v9.38.0 (#3044)
  • 3702308 chore(deps): update dependency rollup to v4.52.5 (#3043)
  • c9c8b39 chore(deps): update dependency typescript-eslint to v8.46.1 (#3025)
  • Additional commits viewable in compare view

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

  • Update to syn 3
Commits
  • 7fc3b4c Release 1.0.229
  • 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
  • 6dec3b7 Update to syn 3
  • cfe6692 Resolve mut_mut pedantic clippy lint
  • 1023d07 Update actions/upload-artifact@v6 -> v7
  • dd682c2 Update actions/checkout@v6 -> v7
  • 5f0f18b Update ui test suite to nightly-2026-06-01
  • 63a1498 Regenerate stderr with trybuild normalization fixes
  • fa7da4a Fix unused_features warning
  • 6b1a178 Unpin CI miri toolchain
  • Additional commits viewable in compare view

Updates serde_json from 1.0.149 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

v1.0.150

Commits
  • de85007 Release 1.0.151
  • 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
  • 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
  • cf16f75 Add RawValue::from_string_unchecked
  • 827a315 Update actions/upload-artifact@v6 -> v7
  • cea36a5 Update actions/checkout@v6 -> v7
  • a1ae73a Release 1.0.150
  • 1a360b0 Merge pull request #1324 from puneetdixit200/reject-non-string-enum-keys
  • 2037b63 Reject non-string enum object keys
  • 5d30df6 Resolve manual_assert_eq pedantic clippy lint
  • Additional commits viewable in compare view

Updates tauri-plugin-prevent-default from 2.1.4 to 5.0.0

Release notes

Sourced from tauri-plugin-prevent-default's releases.

5.0.0

Previously, we registered an event listener for each keyboard shortcut, which meant nearly 20 listeners just for the default ones. This was quite inefficient, so now we register a single listener and use a hashmap to determine whether the event should be prevented. Please open an issue if you notice any unexpected behavior after this update.

The breaking changes are minimal: PreventDefault::script and PreventDefault::try_script have been renamed to PreventDefault::prevent_default_script and PreventDefault::try_prevent_default_script, respectively. Note that this only affects users who manually inject the script. If that’s not your case, you can safely update without making any code changes.

What's Changed

Full Changelog: ferreira-tb/tauri-plugin-prevent-default@4.0.4...5.0.0

4.0.4

What's Changed

New Contributors

Full Changelog: ferreira-tb/tauri-plugin-prevent-default@4.0.3...4.0.4

4.0.3

What's Changed

Full Changelog: ferreira-tb/tauri-plugin-prevent-default@4.0.0...4.0.3

4.0.0

This release refactors the PlatformOptions struct on Windows to use the builder pattern. This makes it very easy to add new options to it. And, of course, I took the opportunity to add those new options. 😄

[!NOTE] This is a breaking change only for those who target Windows.

BEFORE:

use tauri_plugin_prevent_default::PlatformOptions;
tauri_plugin_prevent_default::Builder::new()
.platform(PlatformOptions {
general_autofill: true,
password_autosave: false,
})
.build()

... (truncated)

Commits

Updates notify from 6.1.1 to 8.2.0

Release notes

Sourced from notify's releases.

notify-8.2.0

notify 8.2.0 (2025-08-03)

  • FEATURE: notify user if inotify's max_user_watches has been reached #698
  • FIX: INotifyWatcher ignore events with unknown watch descriptors (instead of EventMask::Q_OVERFLOW) #700

#698: notify-rs/notify#698 #700: notify-rs/notify#700

debouncer-full 0.6.0 (2025-08-03)

  • FEATURE: allow FileIdCache trait implementations to choose ownership of the returned file-ids #664
  • FEATURE: added support for the flume crate #680
  • FIX: skip all Modify events right after a Create event, unless it's a rename event #701

#664: notify-rs/notify#664 #680: notify-rs/notify#680 #701: notify-rs/notify#701

debouncer-mini 0.7.0 (2025-08-03)

  • FEATURE: added support for the flume crate #680

file-id 0.2.3 (2025-08-03)

  • CHANGE: implement AsRef<FileId> for FileId #664

Full Changelog: notify-rs/notify@notify-8.1.0...notify-8.2.0

notify v8.1.0

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from notify's changelog.

notify 8.2.0 (2025-08-03)

  • FEATURE: notify user if inotify's max_user_watches has been reached #698
  • FIX: INotifyWatcher ignore events with unknown watch descriptors (instead of EventMask::Q_OVERFLOW) #700

#698: notify-rs/notify#698 #700: notify-rs/notify#700

debouncer-full 0.6.0 (2025-08-03)

  • FEATURE: allow FileIdCache trait implementations to choose ownership of the returned file-ids #664
  • FEATURE: added support for the flume crate #680
  • FIX: skip all Modify events right after a Create event, unless it's a rename event #701

#664: notify-rs/notify#664 #680: notify-rs/notify#680 #701: notify-rs/notify#701

debouncer-mini 0.7.0 (2025-08-03)

  • FEATURE: added support for the flume crate #680

file-id 0.2.3 (2025-08-03)

  • CHANGE: implement AsRef<FileId> for FileId #664

notify 8.1.0 (2025-07-03)

  • FEATURE: added support for the flume crate
  • FIX: kqueue-backend: do not double unwatch top-level directory when recursively unwatching #683
  • FIX: Return the crate error PathNotFound instead bubbling up the std::io error #685
  • FIX: fix server hangs when trashing folders on Windows #674

notify 8.0.0 (2025-01-10)

  • CHANGE: update notify-types to version 2.0.0
  • CHANGE: raise MSRV to 1.77 breaking
  • FEATURE: add config option to disable following symbolic links #635
  • FIX: unaligned access to FILE_NOTIFY_INFORMATION #647 breaking

#635: notify-rs/notify#635 #647: notify-rs/notify#647

notify-types 2.0.0 (2025-01-10)

  • CHANGE: replace instant crate with web-time #652 breaking
  • CHANGE: the web-time dependency is now behind the web-time feature breaking

#652: notify-rs/notify#652

debouncer-mini 0.6.0 (2025-01-10)

  • CHANGE: update notify to version 8.0.0

debouncer-full 0.5.0 (2025-01-10)

... (truncated)

Commits
  • a1d7c2d Prepare release (#706)
  • c685ea7 Skip all Modify events right after a Create event, unless it's a rename e...
  • e36d54e fix: INotifyWatcher may raise events with no paths (#700)
  • 394ef18 feat(inotify): notify a user if the max_user_watches has been reached impli...
  • 04473de chore: Prepare 8.1.0 release (#697)
  • 12a026d fix: make PathsMut::commit consuming (#695)
  • d824023 feat: introduce Watcher::paths_mut for adding/removing paths in batch (#692)
  • b984134 Do not clone paths while walking dirs (#693)
  • 416ba82 chore: Use MSRV for Clippy and rustfmt (#694)
  • 10ce3ef Update windows-sys to v0.60 (#691)
  • Additional commits viewable in compare view

Updates regex from 1.12.3 to 1.13.1

Changelog

Sourced from regex's changelog.

1.13.1 (2026-07-15)

This is a release that fixes a bug where incorrect regex match offsets could be reported. Note that this doesn't impact whether a match occurs or not, just where it occurs. The match offsets are still valid for slicing, they just may not refer to the correct leftmost-first match. See #1364 for (many) more details.

Bug fixes:

  • #1354: Fixes previously unsound reverse suffix and inner optimizations.

1.13.0 (2026-07-09)

This release includes a new API, a regex! macro, for lazy compilation of a regex from a string literal. If you use regexes a lot, it's likely you've already written one exactly like it. The new macro can be used like this:

use regex::regex;
fn is_match(line: &str) -> bool {
// The regex will be compiled approximately once and reused automatically.
// This avoids the footgun of using Regex::new here, which would
// guarantee that it would be compiled every time this routine is called.
// This would likely make this routine much slower than it needs to be.
regex!(r"bar|baz").is_match(line)
}
let hay = "
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";
let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

  • #709: Add a new regex! macro for efficient and automatic reuse of a compiled regex.

1.12.4 (2026-06-09)

This release includes a performance optimization for compilation of regexes

... (truncated)

Commits
  • 2b52759 1.13.1, redux
  • 40e9823 1.13.1
  • 75fcb96 changelog: 1.13.1
  • 64ad0b6 automata: fix bug in reverse suffix/inner optimization
  • fa91c31 automata: fix a bug caught by Codex review
  • 30390ec automata: formatting tweaks
  • 821a8eb automata: refactor reverse suffix/inner search slightly
  • 10afd70 automata: expose the extracted literals for inner literal extraction
  • 8c34f41 automata: avoid reverse suffix optimization for non-leftmost-first
  • 5524f02 test: add regression tests for failed reverse suffix/inner optimizations
  • Additional commits viewable in compare view

Updates reqwest from 0.12.28 to 0.13.2

Release notes

Sourced from reqwest's releases.

v0.13.2

tl;dr

  • Fix HTTP/2 and native-tls ALPN feature combinations.
  • Fix HTTP/3 to send h3 ALPN.
  • (wasm) fix RequestBuilder::json() from override previously set content-type.

What's Changed

New Contributors

Full Changelog: seanmonstar/reqwest@v0.13.1...v0.13.2

v0.13.1

What's Changed

Full Changelog: seanmonstar/reqwest@v0.13.0...v0.13.1

v0.13.0

Breaking changes

  • rustls is now the default TLS backend, instead of native-tls.
  • rustls crypto provider defaults to aws-lc instead of ring. (rustls-no-provider exists if you want a different crypto provider)
  • rustls-tls has been renamed to rustls.
  • rustls roots features removed, rustls-platform-verifier is used by default.
    • To use different roots, call tls_certs_only(your_roots).
  • native-tls now includes ALPN. To disable, use native-tls-no-alpn.
  • query and form are now crate features, disabled by default.
  • Long-deprecated methods and crate features have been removed (such as trust-dns, which was renamed hickory-dns a while ago).

... (truncated)

Changelog

Sourced from reqwest's changelog.

v0.13.2

  • Fix HTTP/2 and native-tls ALPN feature combinations.
  • Fix HTTP/3 to send h3 ALPN.
  • (wasm) fix RequestBuilder::json() from override previously set content-type.

v0.13.1

  • Fixes compiling with rustls on Android targets.

v0.13.0

  • Breaking changes:
    • rustls is now the default TLS backend, instead of native-tls.
    • rustls crypto provider defaults to aws-lc instead of ring. (rustls-no-provider exists if you want a different crypto provider)
    • rustls-tls has been renamed to rustls.
    • rustls roots features removed, rustls-platform-verifier is used by default.
      • To use different roots, call tls_certs_only(your_roots).
    • native-tls now includes ALPN. To disable, use native-tls-no-alpn.
    • query and form are now crate features, disabled by default.
    • Long-deprecated methods and crate features have been removed (such as trust-dns, which was renamed hickory-dns a while ago).
  • Many TLS-related methods renamed to improve autocompletion and discovery, but previous name left in place with a "soft" deprecation. (just documented, no warnings)
    • For example, prefer tls_backend_rustls() over use_rustls_tls().
Commits

Updates zip from 2.4.2 to 4.6.1

Release notes

Sourced from zip's releases.

v4.6.1

🐛 Bug Fixes

  • Fixes an issue introduced by the swap from lzma-rs to liblzma (#407)

v4.6.0

🚀 Features

  • Allow to read zip files with unsupported extended timestamps (#400)

🐛 Bug Fixes

  • enable clamp_opt for ppmd and xz (#401)

v4.5.0

🚀 Features

  • Allow reading ZIP files where the central directory comes before the files (#384) (#396)

v4.4.0

🚀 Features

  • Add lzma-static and xz-static features that enable liblzma/static (#393)

⚙️ Miscellaneous Tasks

  • Move deprecated annotations to fix a Clippy warning (#391)

v4.3.0

🚀 Features

  • Add support for PPMd (#370)

v4.2.0

🚀 Features

  • Write ZIP file to stream (#246)

v4.1.0

🚀 Features

  • Add has_overlapping_files method

v4.0.0

🐛 Bug Fixes

  • Allow extraction of Zip64 where "Version needed to extract" is higher than "Version made by" (#356)

⚙️ Miscellaneous Tasks

... (truncated)

Changelog

Sourced from zip's changelog.

4.6.1 - 2025-09-03

🐛 Bug Fixes

  • Fixes an issue introduced by the swap from lzma-rs to liblzma (#407)

4.6.0 - 2025-08-30

🚀 Features

  • Allow to read zip files with unsupported extended timestamps (#400)

🐛 Bug Fixes

  • enable clamp_opt for ppmd and xz (#401)

4.5.0 - 2025-08-21

🚀 Features

  • Allow reading ZIP files where the central directory comes before the files (#384) (#396)

4.4.0 - 2025-08-21

🚀 Features

  • Add lzma-static and xz-static features that enable liblzma/static (#393)

⚙️ Miscellaneous Tasks

  • Move deprecated annotations to fix a Clippy warning (#391)

4.3.0 - 2025-07-09

🚀 Features

  • Add support for PPMd (#370)

4.2.0 - 2025-06-21

🚀 Features

  • Write ZIP file to stream (

@dependabot
chore(deps): bump the cargo group in /src-tauri with 17 updates
be9c6ed 
Bumps the cargo group in /src-tauri with 17 updates:

| Package | From | To |
| --- | --- | --- |
| [tauri-plugin-opener](https://github.com/tauri-apps/plugins-workspace) | `2.5.3` | `2.5.4` |
| [tauri-plugin-dialog](https://github.com/tauri-apps/plugins-workspace) | `2.6.0` | `2.7.2` |
| [tauri-plugin-single-instance](https://github.com/tauri-apps/plugins-workspace) | `2.4.0` | `2.4.3` |
| [serde](https://github.com/serde-rs/serde) | `1.0.228` | `1.0.229` |
| [serde_json](https://github.com/serde-rs/json) | `1.0.149` | `1.0.151` |
| [tauri-plugin-prevent-default](https://github.com/ferreira-tb/tauri-plugin-prevent-default) | `2.1.4` | `5.0.0` |
| [notify](https://github.com/notify-rs/notify) | `6.1.1` | `8.2.0` |
| [regex](https://github.com/rust-lang/regex) | `1.12.3` | `1.13.1` |
| [reqwest](https://github.com/seanmonstar/reqwest) | `0.12.28` | `0.13.2` |
| [zip](https://github.com/zip-rs/zip2) | `2.4.2` | `4.6.1` |
| [opener](https://github.com/Seeker14491/opener) | `0.7.2` | `0.8.5` |
| [chrono](https://github.com/chronotope/chrono) | `0.4.44` | `0.4.45` |
| [base64](https://github.com/marshallpierce/rust-base64) | `0.22.1` | `0.23.0` |
| [winreg](https://github.com/gentoo90/winreg-rs) | `0.52.0` | `0.55.0` |
| [webview2-com](https://github.com/wravery/webview2-rs) | `0.38.2` | `0.39.1` |
| [windows](https://github.com/microsoft/windows-rs) | `0.61.3` | `0.62.2` |
| [tauri-build](https://github.com/tauri-apps/tauri) | `2.5.5` | `2.6.3` |


Updates `tauri-plugin-opener` from 2.5.3 to 2.5.4
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@http-v2.5.3...http-v2.5.4)

Updates `tauri-plugin-dialog` from 2.6.0 to 2.7.2
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@log-v2.6.0...dialog-v2.7.2)

Updates `tauri-plugin-single-instance` from 2.4.0 to 2.4.3
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@fs-v2.4.0...fs-v2.4.3)

Updates `serde` from 1.0.228 to 1.0.229
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](serde-rs/serde@v1.0.228...v1.0.229)

Updates `serde_json` from 1.0.149 to 1.0.151
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.149...v1.0.151)

Updates `tauri-plugin-prevent-default` from 2.1.4 to 5.0.0
- [Release notes](https://github.com/ferreira-tb/tauri-plugin-prevent-default/releases)
- [Commits](ferreira-tb/tauri-plugin-prevent-default@2.1.4...5.0.0)

Updates `notify` from 6.1.1 to 8.2.0
- [Release notes](https://github.com/notify-rs/notify/releases)
- [Changelog](https://github.com/notify-rs/notify/blob/notify-8.2.0/CHANGELOG.md)
- [Commits](notify-rs/notify@notify-6.1.1...notify-8.2.0)

Updates `regex` from 1.12.3 to 1.13.1
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](rust-lang/regex@1.12.3...1.13.1)

Updates `reqwest` from 0.12.28 to 0.13.2
- [Release notes](https://github.com/seanmonstar/reqwest/releases)
- [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md)
- [Commits](seanmonstar/reqwest@v0.12.28...v0.13.2)

Updates `zip` from 2.4.2 to 4.6.1
- [Release notes](https://github.com/zip-rs/zip2/releases)
- [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md)
- [Commits](zip-rs/zip2@v2.4.2...v4.6.1)

Updates `opener` from 0.7.2 to 0.8.5
- [Changelog](https://github.com/Seeker14491/opener/blob/master/CHANGELOG.md)
- [Commits](Seeker14491/opener@v0.7.2...v0.8.5)

Updates `chrono` from 0.4.44 to 0.4.45
- [Release notes](https://github.com/chronotope/chrono/releases)
- [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md)
- [Commits](chronotope/chrono@v0.4.44...v0.4.45)

Updates `base64` from 0.22.1 to 0.23.0
- [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md)
- [Commits](marshallpierce/rust-base64@v0.22.1...v0.23.0)

Updates `winreg` from 0.52.0 to 0.55.0
- [Release notes](https://github.com/gentoo90/winreg-rs/releases)
- [Changelog](https://github.com/gentoo90/winreg-rs/blob/master/CHANGELOG.md)
- [Commits](gentoo90/winreg-rs@v0.52.0...v0.55.0)

Updates `webview2-com` from 0.38.2 to 0.39.1
- [Commits](https://github.com/wravery/webview2-rs/commits)

Updates `windows` from 0.61.3 to 0.62.2
- [Release notes](https://github.com/microsoft/windows-rs/releases)
- [Commits](https://github.com/microsoft/windows-rs/commits)

Updates `tauri-build` from 2.5.5 to 2.6.3
- [Release notes](https://github.com/tauri-apps/tauri/releases)
- [Commits](tauri-apps/tauri@tauri-build-v2.5.5...tauri-build-v2.6.3)

---
updated-dependencies:
- dependency-name: tauri-plugin-opener
  dependency-version: 2.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: tauri-plugin-dialog
  dependency-version: 2.7.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: tauri-plugin-single-instance
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: serde
  dependency-version: 1.0.229
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: serde_json
  dependency-version: 1.0.151
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: tauri-plugin-prevent-default
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
- dependency-name: notify
  dependency-version: 8.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
- dependency-name: regex
  dependency-version: 1.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: reqwest
  dependency-version: 0.13.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: zip
  dependency-version: 4.6.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
- dependency-name: opener
  dependency-version: 0.8.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: chrono
  dependency-version: 0.4.45
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: base64
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: winreg
  dependency-version: 0.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: webview2-com
  dependency-version: 0.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: windows
  dependency-version: 0.62.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: tauri-build
  dependency-version: 2.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust labels Aug 6, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 6, 2026
@dependabot
dependabot Bot deleted the dependabot/cargo/src-tauri/cargo-46fe1f5777 branch August 6, 2026 02:43
@PathGao PathGao mentioned this pull request Aug 6, 2026
Merged
@PathGao

PathGao commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

#484 limits every Dependabot group to minor and patch, so majors will open one pull request per dependency instead of landing inside this batch. Recreating this one under the new rules once #484 merges.

Note for whoever handles the rebuilt pair: tauri build fails when a Tauri plugin's crate and npm halves disagree on major or minor, and those halves land in different pull requests (this one and the other ecosystem's). They have to be merged as a pair.

@dependabot recreate

@dependabot @github

dependabot Bot commented on behalf of github Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR is closed. If the branch still exists, you can re-open the PR and then use @dependabot rebase or @dependabot recreate. If the branch was deleted, Dependabot will create a new PR on the next scheduled run, or you can trigger an update from the Dependency graph page.

PathGao added a commit that referenced this pull request Aug 6, 2026
@PathGao @claude
ci(deps): keep major bumps out of the grouped dependency pull request (…
8674be8 
…#484)

#472 gave each ecosystem one grouped pull request a month with
`patterns: ['*']` and no `update-types` filter. The first run showed what
that grouping actually covers:

| PR   | contents  | crossed                                             |
|------|-----------|-----------------------------------------------------|
| #476 | 4 actions | major tags v4 -> v7, merged                          |
| #477 | 11 npm    | TypeScript 5.6 -> 7.0, Vite 6 -> 8                   |
| #478 | 17 crates | tauri-plugin-prevent-default 2 -> 5, notify 6 -> 8   |

Nothing failed. Dependabot's schema check accepts the config, and the
result is a `chore(deps)` title wrapped around a toolchain migration --
a diff whose per-dependency changelogs are the review, presented as a
batch that cannot be split, bisected, or reverted per dependency.

So each group now takes `update-types: [minor, patch]`. Majors fall
outside every group and arrive one pull request per dependency, each
carrying its own changelog. That is the documented shape: "Example:
Individual pull requests for major updates and grouped for minor/patch
updates" in GitHub's guide to optimizing pull request creation, whose
stated result is "All major updates will continue to be raised as
individual pull requests."

`update-types` alone does not suppress anything. The next example in the
same guide, the one titled "no pull requests for major updates", starts
from this exact group and reaches that outcome by *adding* an `ignore`
condition on `version-update:semver-major`. That condition is
deliberately not written here: an `ignore` is a permanent,
repo-invisible mute, and the point of this change is to make majors
visible one at a time, not to stop hearing about them.

`open-pull-requests-limit` goes 2 -> 4 because the shape of a run
changed. Two was sized for "one grouped pull request, plus headroom for
a stale one". With majors opening individually the file now holds one
grouped pull request plus n majors, and a limit of 2 leaves room for
exactly one of them.

One caveat, which is in the config comment because it is invisible from
the config: on a run where a grouped pull request is already open,
Dependabot marks every dependency matching the group's `patterns` as
handled before it consults `update-types`, so that run opens no
individual major pull requests at all. They appear on the first run
after the grouped pull request is merged or closed. Majors are deferred
by an unreviewed batch, not dropped by it.

Separately, and recorded in the config comment because nothing else in
the repository says it: `tauri build` fails when a Tauri plugin's crate
and npm halves disagree on major *or minor*, and Dependabot puts those
two halves in two different pull requests. #478 is red on Linux and
macOS for exactly that -- `tauri-plugin-dialog (v2.7.2) :
@tauri-apps/plugin-dialog (v2.6.0)`, the npm half sitting in #477. That
coupling is not a semver problem and this change does not fix it; the
pair has to be merged as a pair.

The github-actions comment is corrected while it is being rewritten: it
claimed all five actions are tracked by major tag. Four are;
`dtolnay/rust-toolchain@stable` carries no version for Dependabot to
compare.

scripts/dependabotConfig.test.ts locks the four properties this file has
that a reader cannot see: no group lists or admits `major`, every group
stays `applies-to: version-updates` so a security advisory never waits
for the monthly batch, the `interval` matches the cadence the header
comment promises, and the limit stays above the point where the queue
becomes invisible. Each was verified to fail by breaking the property it
claims to protect.

`ecosystemBlocks()` asserts it found blocks, because every check is a
`for` over its result and a `for` over an empty list passes. Measured: an
extra space in each `- package-ecosystem:` line left four of the five
checks green.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This was referenced Aug 6, 2026
Merged
Closed
Open
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@PathGao