[Sadykhzadeh]

Replaces #124, #125, #126, #127. Moves tailwindcss, tailwindcss-animate, postcss and autoprefixer to devDependencies (only the Vite/PostCSS build config uses them), which clears the braces advisory (GHSA-vfj7-8cjw-p6xm, no fixed release) failing security-audit on main and every open PR.

Also updates rustls 0.23.45 → 0.23.46 and quinn-proto 0.11.17 → 0.11.19. cargo audit started reporting RUSTSEC-2026-0346 to -0349 (rustls, live through reqwest and the updater) and RUSTSEC-2026-0338, -0340, -0343 (quinn-proto, locked but not compiled), so without these security-audit would stay red after the npm fix. cargo audit on this lockfile: 0 vulnerabilities, 2 informational warnings (proc-macro-error, glib) that are reported but do not gate.

[Sadykhzadeh]

Since this is crutial security update we need to do the last two steps:

1. Merge Consolidate the four open dependency bumps and clear the npm production audit #128 into main. That puts the audit fix on main.
2. Click “Update branch” on Ask before a host or identity write lets a vault key sign in somewhere new #122 and Put the app's commands behind the capability ACL, trim plugin grants, keep the window on the app's pages #123. Their only failing check, security-audit, should then pass. I tested both PRs merged on top of Consolidate the four open dependency bumps and clear the npm production audit #128 earlier and everything passed with no conflicts.

[Sadykhzadeh]

Since this is crutial security update we need to do the last two steps:

1. Merge Consolidate the four open dependency bumps and clear the npm production audit #128 into main. That puts the audit fix on main.

2. Click “Update branch” on Ask before a host or identity write lets a vault key sign in somewhere new #122 and Put the app's commands behind the capability ACL, trim plugin grants, keep the window on the app's pages #123. Their only failing check, security-audit, should then pass. I tested both PRs merged on top of Consolidate the four open dependency bumps and clear the npm production audit #128 earlier and everything passed with no conflicts.

@computerbox124 FYI

[greptile-apps]

TREX could not finish testing

• Plan what to test
• Set up the environment and test the changed flows
• Post test results

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[Sadykhzadeh]

@computerbox124 merge this one first. It is what turns security-audit green on every other open PR. Full merge order for the security PRs: #157 (comment)

[computerbox124]

Code review: nothing wrong in this PR itself, but two open PRs overlap it.

1. Bump dtolnay/rust-toolchain from e2a55d2ffb04f378e9626c28d38b36d230d1e12f to 683b588c487a69d01f6c6ddf40f036ff682cc2c8 #131 pins dtolnay/rust-toolchain to 683b588c… on the same five lines where this PR pins e2a55d2f… (ci.yml ×3, release.yml, windows-nsis-smoke.yml). 683b588c is the next upstream commit. Whichever merges second conflicts, so after this lands let Dependabot rebase Bump dtolnay/rust-toolchain from e2a55d2ffb04f378e9626c28d38b36d230d1e12f to 683b588c487a69d01f6c6ddf40f036ff682cc2c8 #131 so the newer pin wins.
2. Bump the desktop-minor-and-patch group in /desktop with 8 updates #134 bumps postcss (and leaves tailwindcss / autoprefixer) in dependencies, the same package.json lines this PR moves to devDependencies. If Bump the desktop-minor-and-patch group in /desktop with 8 updates #134 lands first, npm audit --omit=dev stays red and this PR conflicts. Merging this first, as planned, and rebasing Bump the desktop-minor-and-patch group in /desktop with 8 updates #134 avoids that.

Separately, #134 and #136 each bump only one half of the tauri-plugin-shell npm/crate pair and fail tauri build, so they need to land together.

---

Generated by Claude Code

[computerbox124]

@Sadykhzadeh , well done!