Skip to content

chore(deps): bump the cargo group across 1 directory with 7 updates - #489

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/src-tauri/cargo-3bef6f6045
Closed

chore(deps): bump the cargo group across 1 directory with 7 updates#489
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/src-tauri/cargo-3bef6f6045

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the cargo group with 7 updates in the /src-tauri directory:

Package From To
tauri-plugin-opener 2.5.3 2.5.4
tauri-plugin-dialog 2.6.0 2.7.2
tauri-plugin-single-instance 2.4.0 2.4.3
serde 1.0.228 1.0.229
serde_json 1.0.149 1.0.151
regex 1.12.3 1.13.1
tauri-build 2.5.5 2.6.3

Updates tauri-plugin-opener from 2.5.3 to 2.5.4

Release notes

Sourced from tauri-plugin-opener's releases.

opener-js v2.5.4

[2.5.4]

npm warn Unknown user config "always-auth". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-opener@2.5.4
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 3.1kB dist-js/index.cjs
npm notice 2.0kB dist-js/index.d.ts
npm notice 3.1kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 730B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-opener
npm notice version: 2.5.4
npm notice filename: tauri-apps-plugin-opener-2.5.4.tgz
npm notice package size: 3.5 kB
npm notice unpacked size: 14.1 kB
npm notice shasum: b37883e4d36125b8c5a0c74f683395958a65bd7d
npm notice integrity: sha512-1HnPkb+AmgO29[...]aUJtT57lfO9CQ==
npm notice total files: 7
npm notice
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=1429011743
+ @tauri-apps/plugin-opener@2.5.4

opener v2.5.4

[2.5.4]

... (truncated)

Commits

Updates tauri-plugin-dialog from 2.6.0 to 2.7.2

Release notes

Sourced from tauri-plugin-dialog's releases.

dialog-js v2.7.2

[2.7.2]

  • 40ae0a7f (#3491 by @​Legend-Master) Use com.google.android.material.dialog.MaterialAlertDialogBuilder instead of AlertDialog so the dialog follows the app's theme
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-dialog@2.7.2
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.5kB README.md
npm notice 6.9kB dist-js/index.cjs
npm notice 14.6kB dist-js/index.d.ts
npm notice 6.8kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 657B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-dialog
npm notice version: 2.7.2
npm notice filename: tauri-apps-plugin-dialog-2.7.2.tgz
npm notice package size: 6.7 kB
npm notice unpacked size: 33.3 kB
npm notice shasum: 322d0874bae71fed6d10c76168fa0f7f4d5dd875
npm notice integrity: sha512-pX0IGm1I3I6wc[...]0jQGQNyOvLrsg==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2194858458
+ @tauri-apps/plugin-dialog@2.7.2

dialog v2.7.2

[2.7.2]

  • 40ae0a7f (#3491 by @​Legend-Master) Use com.google.android.material.dialog.MaterialAlertDialogBuilder instead of AlertDialog so the dialog follows the app's theme

... (truncated)

Commits

Updates tauri-plugin-single-instance from 2.4.0 to 2.4.3

Release notes

Sourced from tauri-plugin-single-instance's releases.

barcode-scanner-js v2.4.3

[2.4.3]

npm warn Unknown user config "always-auth". This will stop working in the next major version of npm.
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-barcode-scanner@2.4.3
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.3kB README.md
npm notice 2.2kB dist-js/index.cjs
npm notice 1.6kB dist-js/index.d.ts
npm notice 2.1kB dist-js/index.js
npm notice 754B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-barcode-scanner
npm notice version: 2.4.3
npm notice filename: tauri-apps-plugin-barcode-scanner-2.4.3.tgz
npm notice package size: 3.4 kB
npm notice unpacked size: 10.9 kB
npm notice shasum: a401570d2698692fa6878bd816122ac3f8d7142d
npm notice integrity: sha512-y5jIRTFqCeUnc[...]cJWhCfKu6qOQA==
npm notice total files: 6
npm notice
npm notice Security Notice: Classic tokens have been revoked. Granular tokens are now limited to 90 days and require 2FA by default. Update your CI/CD workflows to avoid disruption. Learn more https://gh.io/all-npm-classic-tokens-revoked
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=804717978
+ @tauri-apps/plugin-barcode-scanner@2.4.3

barcode-scanner v2.4.3

[2.4.3]

... (truncated)

Commits
  • 06124af publish new versions (#2972)
  • 060219e chore(deps): update dependency @​rollup/plugin-typescript to v12.3.0 (#3067)
  • c7e9766 chore(deps): update tauri monorepo (v2) (#3058)
  • d4a8ce9 chore(deps): update rust crate tokio-tungstenite to 0.28 (#3016)
  • cdc7eec chore(deps): update dependency @​rollup/plugin-typescript to v12.2.0 (#3066)
  • 6314b00 chore: temp delete updater changefile
  • fb4c8ae chore(deps): update dependency typescript-eslint to v8.46.2 (#3060)
  • fccc1cf chore(deps): update eslint monorepo to v9.38.0 (#3044)
  • 3702308 chore(deps): update dependency rollup to v4.52.5 (#3043)
  • c9c8b39 chore(deps): update dependency typescript-eslint to v8.46.1 (#3025)
  • Additional commits viewable in compare view

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

  • Update to syn 3
Commits
  • 7fc3b4c Release 1.0.229
  • 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
  • 6dec3b7 Update to syn 3
  • cfe6692 Resolve mut_mut pedantic clippy lint
  • 1023d07 Update actions/upload-artifact@v6 -> v7
  • dd682c2 Update actions/checkout@v6 -> v7
  • 5f0f18b Update ui test suite to nightly-2026-06-01
  • 63a1498 Regenerate stderr with trybuild normalization fixes
  • fa7da4a Fix unused_features warning
  • 6b1a178 Unpin CI miri toolchain
  • Additional commits viewable in compare view

Updates serde_json from 1.0.149 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

v1.0.150

Commits
  • de85007 Release 1.0.151
  • 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
  • 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
  • cf16f75 Add RawValue::from_string_unchecked
  • 827a315 Update actions/upload-artifact@v6 -> v7
  • cea36a5 Update actions/checkout@v6 -> v7
  • a1ae73a Release 1.0.150
  • 1a360b0 Merge pull request #1324 from puneetdixit200/reject-non-string-enum-keys
  • 2037b63 Reject non-string enum object keys
  • 5d30df6 Resolve manual_assert_eq pedantic clippy lint
  • Additional commits viewable in compare view

Updates regex from 1.12.3 to 1.13.1

Changelog

Sourced from regex's changelog.

1.13.1 (2026-07-15)

This is a release that fixes a bug where incorrect regex match offsets could be reported. Note that this doesn't impact whether a match occurs or not, just where it occurs. The match offsets are still valid for slicing, they just may not refer to the correct leftmost-first match. See #1364 for (many) more details.

Bug fixes:

  • #1354: Fixes previously unsound reverse suffix and inner optimizations.

1.13.0 (2026-07-09)

This release includes a new API, a regex! macro, for lazy compilation of a regex from a string literal. If you use regexes a lot, it's likely you've already written one exactly like it. The new macro can be used like this:

use regex::regex;
fn is_match(line: &str) -> bool {
// The regex will be compiled approximately once and reused automatically.
// This avoids the footgun of using Regex::new here, which would
// guarantee that it would be compiled every time this routine is called.
// This would likely make this routine much slower than it needs to be.
regex!(r"bar|baz").is_match(line)
}
let hay = "
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";
let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

  • #709: Add a new regex! macro for efficient and automatic reuse of a compiled regex.

1.12.4 (2026-06-09)

This release includes a performance optimization for compilation of regexes

... (truncated)

Commits
  • 2b52759 1.13.1, redux
  • 40e9823 1.13.1
  • 75fcb96 changelog: 1.13.1
  • 64ad0b6 automata: fix bug in reverse suffix/inner optimization
  • fa91c31 automata: fix a bug caught by Codex review
  • 30390ec automata: formatting tweaks
  • 821a8eb automata: refactor reverse suffix/inner search slightly
  • 10afd70 automata: expose the extracted literals for inner literal extraction
  • 8c34f41 automata: avoid reverse suffix optimization for non-leftmost-first
  • 5524f02 test: add regression tests for failed reverse suffix/inner optimizations
  • Additional commits viewable in compare view

Updates tauri-build from 2.5.5 to 2.6.3

Release notes

Sourced from tauri-build's releases.

tauri-build v2.6.3

Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1133 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (1085 crate dependencies)
Crate:     atk
Version:   0.18.2
Warning:   unmaintained
Title:     gtk-rs GTK3 bindings - no longer maintained
Date:      2024-03-04
ID:        RUSTSEC-2024-0413
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0413

Crate:     atk-sys

Version:   0.18.2

Warning:   unmaintained

Title:     gtk-rs GTK3 bindings - no longer maintained

Date:      2024-03-04

ID:        RUSTSEC-2024-0416

URL:       https://rustsec.org/advisories/RUSTSEC-2024-0416


Crate:     fxhash

Version:   0.2.1

Warning:   unmaintained

Title:     fxhash - no longer maintained

Date:      2025-09-05

ID:        RUSTSEC-2025-0057

URL:       https://rustsec.org/advisories/RUSTSEC-2025-0057


Crate:     gdk

Version:   0.18.2

Warning:   unmaintained

Title:     gtk-rs GTK3 bindings - no longer maintained

Date:      2024-03-04

ID:        RUSTSEC-2024-0412

URL:       https://rustsec.org/advisories/RUSTSEC-2024-0412


Crate:     gdk-sys

Version:   0.18.2

Warning:   unmaintained

Title:     gtk-rs GTK3 bindings - no longer maintained

Date:      2024-03-04

ID:        RUSTSEC-2024-0418

URL:       https://rustsec.org/advisories/RUSTSEC-2024-0418


Crate:     gdkwayland-sys

</tr></table>

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust labels Aug 6, 2026
This was referenced Aug 6, 2026
Merged
Closed
@PathGao

PathGao commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

For the record, since this is the first cargo batch built under #484's rules — it came back with the right contents.

7 crates instead of #478's 17, all genuinely minor/patch. Gone from the batch: tauri-plugin-prevent-default 2 → 5, notify 6 → 8, and both windows 0.61.3 → 0.62.2 and webview2-com 0.38.2 → 0.39.1 (Cargo correctly counts a pre-1.0 minor as a major, so they fall outside the group).

It is still red, but on exactly one thing and it is the documented one:

Found version mismatched Tauri packages. Make sure the NPM package and Rust
crate versions are on the same major/minor releases

That is the crate↔npm parity guard — the other half of these Tauri plugin bumps is in #487, and neither PR is green on its own. They have to be merged as a pair; the red build on whichever goes first is expected rather than a reason to close it. No E0599, no windows-core collision, no majors.

PathGao added a commit that referenced this pull request Aug 6, 2026
@PathGao @claude
ci(deps): split the cadence, hold two crates, and stop batching pre-1…
5c1f83f 
….0 npm (#490)

Follow-up to #484, which is now doing its job -- the recreated cargo
batch (#489) came back with 7 minor/patch crates instead of 16 with
majors inside. Three things that first pass did not cover, and one that
was planned and is not here.

**Cadence.** npm and cargo move to `quarterly`; github-actions stays
`monthly`. Security advisories never use this schedule -- they are a
repository setting and open their own pull requests as they land -- so
version updates exist only to stop drift, and drift costs what somebody
else's deadline costs. On Actions somebody else always sets it: runner
images retire toolchains on their own timetable, which is how `build.yml`
came to build releases on a Node pulled from the image toolcache (#485).
An Actions bump is also usually a one-line tag move. Nothing external
forces a TypeScript or a serde upgrade, and a quarter of them in one
grouped pull request is less interrupting and more reviewable than three
monthly ones.

**`minor` does not mean compatible below 1.0, and the two ecosystems
disagree about it.** Dependabot types an npm update from the literal
position of the number, so katex 0.16.47 -> 0.18.1 is a `minor` and went
straight into #487 -- the batch whose whole premise is that it is safe to
skim. It is not: KaTeX 0.18.0 renamed every internal CSS class and 0.17.0
changed `__defineFunction`, both flagged BREAKING upstream. npm's own
caret rule agrees, since `^0.16.47` stops before 0.17.

Cargo does not have this bug. `Dependabot::Cargo::Version` implements the
pre-1.0 rule, so windows 0.61.3 -> 0.62.2 counts as a major -- which is
visible in #489, where those crates are absent from the batch. The npm
side has no equivalent subclass.

There is no `update-types` value for "pre-1.0 minor", and `patterns`
match names rather than versions, so this cannot be written as a rule.
It can be written as a list: `exclude-patterns` names the three pre-1.0
npm dependencies, and they get individual pull requests. The test derives
that list from package.json, so a new 0.x dependency -- or an existing
one reaching 1.0 -- fails the suite instead of quietly rejoining the
batch.

**Two crates held.** `tauri` requires `windows ^0.61` and
`webview2-com ^0.38`, still true at 2.11.5. Taking `windows` 0.62 or
`webview2-com` 0.39 puts two `windows-core` versions in one graph and the
build stops in our own WebView2 call with E0599. Grouping already keeps
them out of the batch; what is left is an individual pull request every
quarter that cannot be merged at any published tauri 2.x.

Bounded to one minor series each rather than written as a semver level,
so the entries lapse. The semver-level form would work -- `Cargo::Version`
overrides `ignored_major_versions` so ">= 0.62" is what major means for a
0.61 crate -- but it would also swallow 0.63 and 0.64 in silence.
`windows` 0.63 does not exist yet; the day it does, Dependabot proposes
it and we find out whether tauri has moved.

The Tauri packages themselves are deliberately not ignored, and the file
says so: the lockfile is on 2.10.2 while 2.11.5 shipped 2026-07-01, and
the red pull request is the only notification there is.

**The cooldown is not here, because the case for it does not survive
being checked.** The mechanism is fine -- `cooldown` is valid alongside
`groups`, dependabot-core passes it on both the grouped and the individual
path, and it cannot touch a security update
(`update_cooldown: job.security_updates_only? ? nil : job.cooldown` in
both). What fails is the premise that the red pull requests are red
because their targets are fresh:

  - typescript 7.0.2 shipped 2026-07-08; svelte-check 4.7.4 shipped
    2026-07-27, nineteen days later, and narrowed its peer range to
    `^5.0.0 || ^6.0.0` -- excluding 7 on purpose.
  - windows 0.62.2 has been out since 2025-10-06 and webview2-com 0.39.1
    since 2026-03-11. Ten months and five.
  - katex 0.18.1 is three weeks old, but it is breaking at any age.
  - the rest is the Tauri parity guard, which is not about age at all.

None of them is a freshness problem. And on a quarterly schedule a major
caught by an N-day window is not delayed N days, it is delayed a quarter.
Also worth recording: GitHub Actions does not support `semver-major-days`
at all, so a cooldown could never have applied to the one ecosystem that
stays monthly.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
@dependabot
chore(deps): bump the cargo group across 1 directory with 7 updates
bd574ae 
Bumps the cargo group with 7 updates in the /src-tauri directory:

| Package | From | To |
| --- | --- | --- |
| [tauri-plugin-opener](https://github.com/tauri-apps/plugins-workspace) | `2.5.3` | `2.5.4` |
| [tauri-plugin-dialog](https://github.com/tauri-apps/plugins-workspace) | `2.6.0` | `2.7.2` |
| [tauri-plugin-single-instance](https://github.com/tauri-apps/plugins-workspace) | `2.4.0` | `2.4.3` |
| [serde](https://github.com/serde-rs/serde) | `1.0.228` | `1.0.229` |
| [serde_json](https://github.com/serde-rs/json) | `1.0.149` | `1.0.151` |
| [regex](https://github.com/rust-lang/regex) | `1.12.3` | `1.13.1` |
| [tauri-build](https://github.com/tauri-apps/tauri) | `2.5.5` | `2.6.3` |



Updates `tauri-plugin-opener` from 2.5.3 to 2.5.4
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@http-v2.5.3...http-v2.5.4)

Updates `tauri-plugin-dialog` from 2.6.0 to 2.7.2
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@log-v2.6.0...dialog-v2.7.2)

Updates `tauri-plugin-single-instance` from 2.4.0 to 2.4.3
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@fs-v2.4.0...fs-v2.4.3)

Updates `serde` from 1.0.228 to 1.0.229
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](serde-rs/serde@v1.0.228...v1.0.229)

Updates `serde_json` from 1.0.149 to 1.0.151
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.149...v1.0.151)

Updates `regex` from 1.12.3 to 1.13.1
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](rust-lang/regex@1.12.3...1.13.1)

Updates `tauri-build` from 2.5.5 to 2.6.3
- [Release notes](https://github.com/tauri-apps/tauri/releases)
- [Commits](tauri-apps/tauri@tauri-build-v2.5.5...tauri-build-v2.6.3)

---
updated-dependencies:
- dependency-name: regex
  dependency-version: 1.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: serde
  dependency-version: 1.0.229
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: serde_json
  dependency-version: 1.0.151
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: tauri-build
  dependency-version: 2.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: tauri-plugin-dialog
  dependency-version: 2.7.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: tauri-plugin-opener
  dependency-version: 2.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: tauri-plugin-single-instance
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/src-tauri/cargo-3bef6f6045 branch from e5cd9b1 to bd574ae Compare August 6, 2026 03:32
@PathGao

PathGao commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

Closing this without merging, and recording why so the next quarterly run is not re-litigated from scratch.

These two batches are two halves of one bump. #491 carries the npm side of the Tauri family, this carries the crate side, and tauri build refuses when a plugin's crate and npm halves disagree on major or minor — tauri-plugin-dialog (v2.7.2) : @tauri-apps/plugin-dialog (v2.6.0). Dependabot groups per ecosystem and cannot see across that line, so neither PR can merge on its own and both stay red. Taking them would mean a hand-made pull request carrying both halves.

That work is only worth doing if the bump is worth having, and I could not establish that it is. What is actually in here, checked against the upstream changelogs rather than assumed:

  • tauri-plugin-dialog 2.6.0 → 2.7.2 — 2.7.2 changes the Android dialog to MaterialAlertDialogBuilder; 2.7.1 is a dependency bump; 2.7.0 makes ask/confirm reuse the message command internally and turns their permissions into aliases. Markpad is desktop-only. Nothing user-visible here.
  • tauri-plugin-opener, tauri-plugin-single-instance, serde, serde_json, regex — patch bumps.
  • tauri-build 2.5.5 → 2.6.3 and @tauri-apps/cli 2.9.6 → 2.11.4 — I expected these to clear the Failed to add bundler type to the binary: __TAURI_BUNDLE_TYPE variable not found warning in the release build, since that warning's own text suggests exactly this. They will not: the fix (tauri#13808, add #[used] to __TAURI_BUNDLE_TYPE so that it's not stripped in release builds) landed 2025-07-11, well before the 2.10.2 in our lockfile. The warning has some other cause, and it is harmless either way — the updater falls back to the unsuffixed {os}-{arch} key and our latest.json publishes only those.

So the batch clears no bug and adds no capability this app uses. Merging it would be motion, not progress.

What would change the answer. tauri itself is pinned at 2.10.2 while 2.11.5 has been out since 2026-07-01, and no Dependabot pull request has touched it — that is being looked into separately, because a bot that cannot see the core framework is a hole in the reporting, independent of whether the upgrade is wanted. If the core turns out to be takeable, the right shape is one hand-made pull request moving the whole Tauri family together, and these contents come along with it.

Since #490 moved npm and cargo to a quarterly schedule, this returns on its own in about three months. Nothing is lost by closing it now.

@PathGao PathGao closed this Aug 6, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/cargo/src-tauri/cargo-3bef6f6045 branch August 6, 2026 03:39
This was referenced Aug 6, 2026
Closed
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@PathGao