Skip to content

build(deps): bump the cargo-minor-and-patch group in /src-tauri with 8 updates - #353

Merged
JJJ merged 4 commits into
mainfrom
dependabot/cargo/src-tauri/cargo-minor-and-patch-571b1c2f4e
Oct 5, 2026
Merged

build(deps): bump the cargo-minor-and-patch group in /src-tauri with 8 updates#353
JJJ merged 4 commits into
mainfrom
dependabot/cargo/src-tauri/cargo-minor-and-patch-571b1c2f4e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 5, 2026

Copy link
Copy Markdown
Contributor

Bumps the cargo-minor-and-patch group in /src-tauri with 8 updates:

Package From To
tauri 2.11.6 2.12.1
tauri-plugin-global-shortcut 2.3.2 2.4.0
tauri-plugin-autostart 2.5.1 2.7.0
tauri-plugin-single-instance 2.4.5 2.5.2
tauri-plugin-window-state 2.4.1 2.5.0
tauri-plugin-dialog 2.7.3 2.8.1
tauri-plugin-updater 2.12.0 2.13.1
tauri-build 2.6.3 2.7.1

Updates tauri from 2.11.6 to 2.12.1

Release notes

Sourced from tauri's releases.

tauri-cli v2.12.1

Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1277 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (1091 crate dependencies)
Crate:     fxhash
Version:   0.2.1
Warning:   unmaintained
Title:     fxhash - no longer maintained
Date:      2025-09-05
ID:        RUSTSEC-2025-0057
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0057

Crate:     paste

Version:   1.0.15

Warning:   unmaintained

Title:     paste - no longer maintained

Date:      2024-10-07

ID:        RUSTSEC-2024-0436

URL:       https://rustsec.org/advisories/RUSTSEC-2024-0436


Crate:     rustls-pemfile

Version:   2.2.0

Warning:   unmaintained

Title:     rustls-pemfile is unmaintained

Date:      2025-11-28

ID:        RUSTSEC-2025-0134

URL:       https://rustsec.org/advisories/RUSTSEC-2025-0134


Crate:     rustybuzz

Version:   0.20.1

Warning:   unmaintained

Title:     rustybuzz is unmaintained

Date:      2026-07-11

ID:        RUSTSEC-2026-0206

URL:       https://rustsec.org/advisories/RUSTSEC-2026-0206


Crate:     ttf-parser

Version:   0.25.1

Warning:   unmaintained

Title:     ttf-parser is unmaintained

Date:      2026-06-28

ID:        RUSTSEC-2026-0192

URL:       https://rustsec.org/advisories/RUSTSEC-2026-0192


warning: 5 allowed warnings found

</tr></table>

... (truncated)

Commits

Updates tauri-plugin-global-shortcut from 2.3.2 to 2.4.0

Release notes

Sourced from tauri-plugin-global-shortcut's releases.

stronghold-js v2.4.0

[2.4.0]

  • ae3c808e (#3602) The plugin's global API script (used with app.withGlobalTauri) now resolves the core API from window.__TAURI__ instead of bundling its own copy of @tauri-apps/api. Values created with the core API are now accepted by plugin APIs in global mode (e.g. an Image from window.__TAURI__.image passed to clipboardManager.writeImage, which previously failed the instanceof check against the plugin's private copy), and the script is considerably smaller.
  • 9b29b601 Update MSRV to 1.90 to match tauri.
  • a87a3c7d Update documentation.
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-stronghold@2.4.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.7kB README.md
npm notice 19.4kB dist-js/index.cjs
npm notice 21.1kB dist-js/index.d.ts
npm notice 19.2kB dist-js/index.js
npm notice 750B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-stronghold
npm notice version: 2.4.0
npm notice filename: tauri-apps-plugin-stronghold-2.4.0.tgz
npm notice package size: 8.7 kB
npm notice unpacked size: 66.0 kB
npm notice shasum: 47b370840be057acd7d8f76046a9978a622cfcbe
npm notice integrity: sha512-5FIKueS+4xs66[...]j7Mzwt0NX4r1A==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2969525576
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-stronghold@2.4.0

stronghold v2.4.0

[2.4.0]

  • ae3c808e (#3602) The plugin's global API script (used with app.withGlobalTauri) now resolves the core API from window.__TAURI__ instead of bundling its own copy of @tauri-apps/api. Values created with the core API are now accepted by plugin APIs in global mode (e.g. an Image from window.__TAURI__.image passed to clipboardManager.writeImage, which previously failed the instanceof check against the plugin's private copy), and the script is considerably smaller.
  • 9b29b601 Update MSRV to 1.90 to match tauri.
  • a87a3c7d Update documentation.

... (truncated)

Commits

Updates tauri-plugin-autostart from 2.5.1 to 2.7.0

Release notes

Sourced from tauri-plugin-autostart's releases.

opener-js v2.7.0

[2.7.0]

  • ecd3273e (#3480 by @​renovate) Updated windows-rs dependencies:

    • deep-link: updated windows-registry to 0.6 and windows-result to 0.4. The public Error::Windows variant wraps windows_result::Error; applications using this type directly should update their windows-result dependency.
    • opener: updated windows to 0.62. The public Error::Win32Error variant wraps windows::core::Error; applications using this type directly should update their windows dependency.
    • single-instance: updated windows-sys to 0.61
    • updater: updated windows-sys to 0.61
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-opener@2.7.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 3.1kB dist-js/index.cjs
npm notice 2.0kB dist-js/index.d.ts
npm notice 3.1kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 730B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-opener
npm notice version: 2.7.0
npm notice filename: tauri-apps-plugin-opener-2.7.0.tgz
npm notice package size: 3.5 kB
npm notice unpacked size: 14.1 kB
npm notice shasum: 14d631a70282cbc07b46f4442ba6085d2200f301
npm notice integrity: sha512-mBorYfVKh9Lt7[...]5OHHVmipjuGMw==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3005263072
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-opener@2.7.0

opener v2.7.0

[2.7.0]

... (truncated)

Commits
  • 51b430b ci: delete .changes/updater-new-bundle-support.md
  • fd439b1 Publish New Versions (v2) (#2964)
  • 2522b71 fix(deep-link): revert the breaking change introduced by #2928 (#2970)
  • 9021a73 chore(deps): update dependency rollup to v4.50.0 (#2966)
  • 625bb1c feat(log): re-export the log crate (#2965)
  • 6215afe chore(deps): update dependency rollup to v4.49.0 (#2962)
  • 8cf8eea feat(updater): inject bundle_type into endpoint url (#2960)
  • 509eba8 feat: support message dialogs with 3 buttons (#2641)
  • 9ac5fe8 feat(updater): support bundle-specific targets (#2624)
  • c247410 chore(deps): update dependency typescript-eslint to v8.41.0 (#2956)
  • Additional commits viewable in compare view

Updates tauri-plugin-single-instance from 2.4.5 to 2.5.2

Release notes

Sourced from tauri-plugin-single-instance's releases.

single-instance v2.5.2

[2.5.2]

Dependencies

  • Upgraded to deep-link@2.6.1
Updating crates.io index
   Packaging tauri-plugin-single-instance v2.5.2 (/home/runner/work/plugins-workspace/plugins-workspace/plugins/single-instance)
    Updating crates.io index
warning: package `yoke-derive v0.8.3` in Cargo.lock is yanked in registry `crates-io`
  |
  = help: consider updating to a version that is not yanked
    Packaged 15 files, 168.3KiB (46.0KiB compressed)
   Uploading tauri-plugin-single-instance v2.5.2 (/home/runner/work/plugins-workspace/plugins-workspace/plugins/single-instance)
    Uploaded tauri-plugin-single-instance v2.5.2 to registry `crates-io`
note: waiting for tauri-plugin-single-instance v2.5.2 to be available at registry `crates-io`
help: you may press ctrl-c to skip waiting; the crate should be available shortly
   Published tauri-plugin-single-instance v2.5.2 at registry `crates-io`

single-instance v2.5.1

[2.5.1]

  • ecd3273e (#3480 by @​renovate) Updated windows-rs dependencies:

    • deep-link: updated windows-registry to 0.6 and windows-result to 0.4. The public Error::Windows variant wraps windows_result::Error; applications using this type directly should update their windows-result dependency.
    • opener: updated windows to 0.62. The public Error::Win32Error variant wraps windows::core::Error; applications using this type directly should update their windows dependency.
    • single-instance: updated windows-sys to 0.61
    • updater: updated windows-sys to 0.61

Dependencies

  • Upgraded to deep-link@2.6.0
Updating crates.io index
   Packaging tauri-plugin-single-instance v2.5.1 (/home/runner/work/plugins-workspace/plugins-workspace/plugins/single-instance)
    Updating crates.io index
    Packaged 15 files, 168.2KiB (46.0KiB compressed)
   Uploading tauri-plugin-single-instance v2.5.1 (/home/runner/work/plugins-workspace/plugins-workspace/plugins/single-instance)
</tr></table>

... (truncated)

Commits

Updates tauri-plugin-window-state from 2.4.1 to 2.5.0

Release notes

Sourced from tauri-plugin-window-state's releases.

sql-js v2.5.0

[2.5.0]

  • ae3c808e (#3602) The plugin's global API script (used with app.withGlobalTauri) now resolves the core API from window.__TAURI__ instead of bundling its own copy of @tauri-apps/api. Values created with the core API are now accepted by plugin APIs in global mode (e.g. an Image from window.__TAURI__.image passed to clipboardManager.writeImage, which previously failed the instanceof check against the plugin's private copy), and the script is considerably smaller.
  • 9b29b601 Update MSRV to 1.90 to match tauri.
  • a87a3c7d Update documentation.
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-sql@2.5.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 6.2kB README.md
npm notice 6.5kB dist-js/index.cjs
npm notice 6.1kB dist-js/index.d.ts
npm notice 6.5kB dist-js/index.js
npm notice 703B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-sql
npm notice version: 2.5.0
npm notice filename: tauri-apps-plugin-sql-2.5.0.tgz
npm notice package size: 5.3 kB
npm notice unpacked size: 27.0 kB
npm notice shasum: f2806141a23eab9347aed34efa0efa15930e8dae
npm notice integrity: sha512-wHzfXAgMbn3G1[...]kFZrgTyu8zBkw==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2969525463
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-sql@2.5.0

sql v2.5.0

[2.5.0]

  • ae3c808e (#3602) The plugin's global API script (used with app.withGlobalTauri) now resolves the core API from window.__TAURI__ instead of bundling its own copy of @tauri-apps/api. Values created with the core API are now accepted by plugin APIs in global mode (e.g. an Image from window.__TAURI__.image passed to clipboardManager.writeImage, which previously failed the instanceof check against the plugin's private copy), and the script is considerably smaller.
  • 9b29b601 Update MSRV to 1.90 to match tauri.
  • a87a3c7d Update documentation.

... (truncated)

Commits
  • d6a3898 Publish New Versions (v2) (#3268)
  • 2e5bcdf chore(deps): fix audits (#3373)
  • 4374b4f chore(notification): remove unused dev-deps (#3372)
  • f75d21d chore(deps): remove used of tauri-utils build feature (#3360)
  • 4b95f5e chore(deps): update dependency eslint to v10.1.0 (#3357)
  • 99c3e37 chore(deps): bump tar in /plugins/updater/tests/updater-migration/v1-app (#3352)
  • eaac19a chore(deps): update rust crate tar to v0.4.45 [security] (#3353)
  • 5183e31 chore(deps): update dependency typescript-eslint to v8.57.1 (#3344)
  • 2c0883e chore(deps): update dependency vite to v8 (#3346)
  • 024ec0c fix(deep-link): ChromeOS deep link calls filtered and ignored by plugin (fix ...
  • Additional commits viewable in compare view

Updates tauri-plugin-dialog from 2.7.3 to 2.8.1

Release notes

Sourced from tauri-plugin-dialog's releases.

dialog-js v2.8.1

[2.8.1]

  • 569ee82c Fix the docs.rs build for Android: the build script now detects docs.rs through the DOCS_RS environment variable, since cfg(docsrs) is never set for build scripts.
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-dialog@2.8.1
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.5kB README.md
npm notice 7.1kB dist-js/index.cjs
npm notice 15.1kB dist-js/index.d.ts
npm notice 7.0kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 657B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-dialog
npm notice version: 2.8.1
npm notice filename: tauri-apps-plugin-dialog-2.8.1.tgz
npm notice package size: 6.8 kB
npm notice unpacked size: 34.3 kB
npm notice shasum: f29f3c28862a1ed767b6fd241f34abf26129f88f
npm notice integrity: sha512-/DtE3B62JgpYu[...]phsKnb+738Dmw==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3028120915
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-dialog@2.8.1

dialog v2.8.1

[2.8.1]

  • 569ee82c Fix the docs.rs build for Android: the build script now detects docs.rs through the DOCS_RS environment variable, since cfg(docsrs) is never set for build scripts.

... (truncated)

Commits
  • d4835d0 publish new versions (#3660)
  • 569ee82 fix: mobile docs.rs builds
  • 25f3874 chore(deps): update dependency eslint-plugin-security to v4.1.0 (#3661)
  • 2fd4bed chore(autostart): update auto-launch to 0.6 (#3546)
  • e511284 publish new versions (#3647)
  • ce59e96 docs(log): remove unrelated single-instance comment from log readme
  • 29130c2 ci: run clippy on all platforms (#3650)
  • 4353819 chore: add changefile to re-release plugin-http npm package as 2.8.0 (#3656)
  • ec14142 chore(deps): update dependency @​types/node to v24 (#3649)
  • 90b9869 chore(deps): update rust crate dirs to v7 (#3573)
  • Additional commits viewable in compare view

Updates tauri-plugin-updater from 2.12.0 to 2.13.1

Release notes

Sourced from tauri-plugin-updater's releases.

updater-js v2.13.1

[2.13.1]

  • ecd3273e (#3480 by @​renovate) Updated windows-rs dependencies:

    • deep-link: updated windows-registry to 0.6 and windows-result to 0.4. The public Error::Windows variant wraps windows_result::Error; applications using this type directly should update their windows-result dependency.
    • opener: updated windows to 0.62. The public Error::Win32Error variant wraps windows::core::Error; applications using this type directly should update their windows dependency.
    • single-instance: updated windows-sys to 0.61
    • updater: updated windows-sys to 0.61

  • 90b9869e (#3573 by @​renovate) Updated dirs to v7

  • 22e286f3 (#3501 by @​renovate) Updated dependency infer to 0.22

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-updater@2.13.1
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.2kB README.md
npm notice 6.7kB dist-js/index.cjs
npm notice 7.1kB dist-js/index.d.ts
npm notice 6.6kB dist-js/index.js
npm notice 659B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-updater
npm notice version: 2.13.1
npm notice filename: tauri-apps-plugin-updater-2.13.1.tgz
npm notice package size: 4.8 kB
npm notice unpacked size: 25.1 kB
npm notice shasum: 2ad227ba05293fe34c5c59c0ff8a1cd690c8e9a8
npm notice integrity: sha512-+STDzJ0sdQLIm[...]/AJz0jxysytiw==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3005269671
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-updater@2.13.1

updater v2.13.1

... (truncated)

Commits
  • e511284 publish new versions (#3647)
  • ce59e96 docs(log): remove unrelated single-instance comment from log readme
  • 29130c2 ci: run clippy on all platforms (#3650)
  • 4353819 chore: add changefile to re-release plugin-http npm package as 2.8.0 (#3656)
  • ec14142 chore(deps): update dependency @​types/node to v24 (#3649)
  • 90b9869 chore(deps): update rust crate dirs to v7 (#3573)
  • 22e286f chore(deps): update rust crate infer to 0.22 (#3501)
  • ecd3273 chore(deps): update windows-rs and webview2 crates (#3480)
  • aa2cc64 fix(android): Migrate Gradle scripts to compilerOptions DSL (#3478)
  • a2364a5 fix: integration test
  • Additional commits viewable in compare view

Updates tauri-build from 2.6.3 to 2.7.1

Release notes

Sourced from tauri-build's releases.

tauri-build v2.7.1

Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1277 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (1091 crate dependencies)
Crate:     fxhash
Version:   0.2.1
Warning:   unmaintained
Title:     fxhash - no longer maintained
Date:      2025-09-05
ID:        RUSTSEC-2025-0057
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0057

Crate:     paste

Version:   1.0.15

Warning:   unmaintained

Title:     paste - no longer maintained

Date:      2024-10-07

ID:        RUSTSEC-2024-0436

URL:       https://rustsec.org/advisories/RUSTSEC-2024-0436


Crate:     rustls-pemfile

Version:   2.2.0

Warning:   unmaintained

Title:     rustls-pemfile is unmaintained

Date:      2025-11-28

ID:        RUSTSEC-2025-0134

URL:       https://rustsec.org/advisories/RUSTSEC-2025-0134


Crate:     rustybuzz

Version:   0.20.1

Warning:   unmaintained

Title:     rustybuzz is unmaintained

Date:      2026-07-11

ID:        RUSTSEC-2026-0206

URL:       https://rustsec.org/advisories/RUSTSEC-2026-0206


Crate:     ttf-parser

Version:   0.25.1

Warning:   unmaintained

Title:     ttf-parser is unmaintained

Date:      2026-06-28

ID:        RUSTSEC-2026-0192

URL:       https://rustsec.org/advisories/RUSTSEC-2026-0192


warning: 5 allowed warnings found

</tr></table>

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the cargo-minor-and-patch group
32b431b 
Bumps the cargo-minor-and-patch group in /src-tauri with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [tauri](https://github.com/tauri-apps/tauri) | `2.11.6` | `2.12.1` |
| [tauri-plugin-global-shortcut](https://github.com/tauri-apps/plugins-workspace) | `2.3.2` | `2.4.0` |
| [tauri-plugin-autostart](https://github.com/tauri-apps/plugins-workspace) | `2.5.1` | `2.7.0` |
| [tauri-plugin-single-instance](https://github.com/tauri-apps/plugins-workspace) | `2.4.5` | `2.5.2` |
| [tauri-plugin-window-state](https://github.com/tauri-apps/plugins-workspace) | `2.4.1` | `2.5.0` |
| [tauri-plugin-dialog](https://github.com/tauri-apps/plugins-workspace) | `2.7.3` | `2.8.1` |
| [tauri-plugin-updater](https://github.com/tauri-apps/plugins-workspace) | `2.12.0` | `2.13.1` |
| [tauri-build](https://github.com/tauri-apps/tauri) | `2.6.3` | `2.7.1` |


Updates `tauri` from 2.11.6 to 2.12.1
- [Release notes](https://github.com/tauri-apps/tauri/releases)
- [Commits](tauri-apps/tauri@tauri-v2.11.6...tauri-v2.12.1)

Updates `tauri-plugin-global-shortcut` from 2.3.2 to 2.4.0
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@os-v2.3.2...os-v2.4.0)

Updates `tauri-plugin-autostart` from 2.5.1 to 2.7.0
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@fs-v2.5.1...log-v2.7.0)

Updates `tauri-plugin-single-instance` from 2.4.5 to 2.5.2
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@fs-v2.4.5...fs-v2.5.2)

Updates `tauri-plugin-window-state` from 2.4.1 to 2.5.0
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@fs-v2.4.1...fs-v2.5.0)

Updates `tauri-plugin-dialog` from 2.7.3 to 2.8.1
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@dialog-v2.7.3...dialog-v2.8.1)

Updates `tauri-plugin-updater` from 2.12.0 to 2.13.1
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@updater-v2.12.0...updater-v2.13.1)

Updates `tauri-build` from 2.6.3 to 2.7.1
- [Release notes](https://github.com/tauri-apps/tauri/releases)
- [Commits](tauri-apps/tauri@tauri-build-v2.6.3...tauri-build-v2.7.1)

---
updated-dependencies:
- dependency-name: tauri
  dependency-version: 2.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-and-patch
- dependency-name: tauri-plugin-global-shortcut
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-and-patch
- dependency-name: tauri-plugin-autostart
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-and-patch
- dependency-name: tauri-plugin-single-instance
  dependency-version: 2.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-and-patch
- dependency-name: tauri-plugin-window-state
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-and-patch
- dependency-name: tauri-plugin-dialog
  dependency-version: 2.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-and-patch
- dependency-name: tauri-plugin-updater
  dependency-version: 2.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-and-patch
- dependency-name: tauri-build
  dependency-version: 2.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from JJJ as a code owner October 5, 2026 15:18
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 5, 2026
@github-actions

github-actions Bot commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ❌ 1 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.
  • ⚠️ 2 packages with OpenSSF Scorecard issues.
See the Details below.

License Issues

src-tauri/Cargo.lock

PackageVersionLicenseIssue Type
brotli-decompressor6.0.1LicenseRef-bad-bsd-3-clausemitIncompatible License
Allowed Licenses: 0BSD, Apache-2.0, BSD-2-Clause, BSD-3-Clause, BSL-1.0, CC0-1.0, ISC, MIT, MIT-0, MPL-2.0, Unicode-3.0, Unlicense, Zlib
Excluded from license check: pkg:githubactions/Swatinem/rust-cache, pkg:cargo/webpki-root-certs

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
cargo/alloc-no-stdlib 3.0.0 ⚠️ 2.1
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ -1No tokens found
Code-Review⚠️ 1Found 3/28 approved changesets -- score normalized to 1
Dangerous-Workflow⚠️ -1no workflows found
Pinned-Dependencies⚠️ -1no dependencies found
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
cargo/alloc-stdlib 0.3.0 ⚠️ 2.1
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ -1No tokens found
Code-Review⚠️ 1Found 3/28 approved changesets -- score normalized to 1
Dangerous-Workflow⚠️ -1no workflows found
Pinned-Dependencies⚠️ -1no dependencies found
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
cargo/auto-launch 0.6.0 UnknownUnknown
cargo/brotli 9.0.0 🟢 4.3
Details
CheckScoreReason
Code-Review🟢 5Found 14/26 approved changesets -- score normalized to 5
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 89 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 8
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
cargo/brotli-decompressor 6.0.1 🟢 5.1
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ -1No tokens found
Code-Review🟢 4Found 13/28 approved changesets -- score normalized to 4
Dangerous-Workflow⚠️ -1no workflows found
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ -1no dependencies found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
cargo/cargo_toml 1.0.1 UnknownUnknown
cargo/cssparser 0.37.0 🟢 6
Details
CheckScoreReason
Code-Review🟢 9Found 29/30 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1016 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
cargo/cssparser-macros 0.7.1 🟢 6
Details
CheckScoreReason
Code-Review🟢 9Found 29/30 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1016 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
cargo/ctor 1.0.13 UnknownUnknown
cargo/dom_query 0.28.0 UnknownUnknown
cargo/html5ever 0.39.0 🟢 6.1
Details
CheckScoreReason
Maintained🟢 1020 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing🟢 10project is fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
cargo/json-patch 4.2.0 🟢 3.5
Details
CheckScoreReason
Code-Review🟢 4Found 12/25 approved changesets -- score normalized to 4
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
cargo/jsonptr 0.7.1 UnknownUnknown
cargo/keyboard-types 0.8.3 UnknownUnknown
cargo/markup5ever 0.39.0 🟢 6.1
Details
CheckScoreReason
Maintained🟢 1020 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing🟢 10project is fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
cargo/muda 0.20.0 UnknownUnknown
cargo/ndk-context 0.1.1 UnknownUnknown
cargo/nix 0.31.3 🟢 5.2
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Code-Review🟢 8Found 26/30 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
cargo/objc2-security 0.3.2 UnknownUnknown
cargo/objc2-service-management 0.3.2 UnknownUnknown
cargo/os_info 3.15.0 🟢 3.9
Details
CheckScoreReason
Code-Review🟢 7Found 9/12 approved changesets -- score normalized to 7
Packaging⚠️ -1packaging workflow not detected
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
cargo/selectors 0.38.0 UnknownUnknown
cargo/smappservice-rs 0.1.3 UnknownUnknown
cargo/tao 0.37.1 🟢 5.3
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 9Found 24/26 approved changesets -- score normalized to 9
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Security-Policy⚠️ 0security policy file not detected
SAST⚠️ 1SAST tool is not run on all commits -- score normalized to 1
cargo/tauri 2.12.1 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 4Found 13/29 approved changesets -- score normalized to 4
Maintained🟢 1030 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 7binaries present in source code
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
SAST🟢 8SAST tool is not run on all commits -- score normalized to 8
cargo/tauri-build 2.7.1 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 4Found 13/29 approved changesets -- score normalized to 4
Maintained🟢 1030 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 7binaries present in source code
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
SAST🟢 8SAST tool is not run on all commits -- score normalized to 8
cargo/tauri-codegen 2.7.1 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 4Found 13/29 approved changesets -- score normalized to 4
Maintained🟢 1030 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 7binaries present in source code
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
SAST🟢 8SAST tool is not run on all commits -- score normalized to 8
cargo/tauri-macros 2.7.1 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 4Found 13/29 approved changesets -- score normalized to 4
Maintained🟢 1030 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 7binaries present in source code
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
SAST🟢 8SAST tool is not run on all commits -- score normalized to 8
cargo/tauri-plugin 2.7.1 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 4Found 13/29 approved changesets -- score normalized to 4
Maintained🟢 1030 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 7binaries present in source code
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
SAST🟢 8SAST tool is not run on all commits -- score normalized to 8
cargo/tauri-plugin-autostart 2.7.0 UnknownUnknown
cargo/tauri-plugin-dialog 2.8.1 UnknownUnknown
cargo/tauri-plugin-fs 2.6.0 UnknownUnknown
cargo/tauri-plugin-global-shortcut 2.4.0 UnknownUnknown
cargo/tauri-plugin-single-instance 2.5.2 UnknownUnknown
cargo/tauri-plugin-updater 2.13.1 UnknownUnknown
cargo/tauri-plugin-window-state 2.5.0 UnknownUnknown
cargo/tauri-runtime 2.12.1 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 4Found 13/29 approved changesets -- score normalized to 4
Maintained🟢 1030 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 7binaries present in source code
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
SAST🟢 8SAST tool is not run on all commits -- score normalized to 8
cargo/tauri-runtime-wry 2.12.1 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 4Found 13/29 approved changesets -- score normalized to 4
Maintained🟢 1030 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 7binaries present in source code
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
SAST🟢 8SAST tool is not run on all commits -- score normalized to 8
cargo/tauri-utils 2.10.1 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 4Found 13/29 approved changesets -- score normalized to 4
Maintained🟢 1030 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 7binaries present in source code
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
SAST🟢 8SAST tool is not run on all commits -- score normalized to 8
cargo/tray-icon 0.25.1 UnknownUnknown
cargo/urlpattern 0.6.0 UnknownUnknown
cargo/webview2-com 0.39.1 UnknownUnknown
cargo/webview2-com-sys 0.39.1 UnknownUnknown
cargo/wry 0.57.0 🟢 5.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 4security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 9binaries present in source code
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 3SAST tool is not run on all commits -- score normalized to 3

Scanned Files

  • src-tauri/Cargo.lock

@JJJ JJJ mentioned this pull request Oct 5, 2026
Merged
JJJ added 2 commits October 5, 2026 18:26
@JJJ
Build: Reconcile Cargo dependency artifacts with main.
4f95d62 
Merge the npm and Actions updates into the Cargo Dependabot branch, then regenerate the combined third-party notices and SBOM from both lockfiles.
@JJJ
Build: Include the reviewed Cargo license guard.
af0545c 
Merge the approved brotli-decompressor license review into the Cargo Dependabot branch so dependency review and the lockfile version audit apply to this update.
@JJJ
JJJ merged commit cc46501 into main Oct 5, 2026
19 checks passed
@JJJ
JJJ deleted the dependabot/cargo/src-tauri/cargo-minor-and-patch-571b1c2f4e branch October 5, 2026 23:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JJJ JJJ Awaiting requested review from JJJ JJJ is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@JJJ