[dependabot]

Bumps the production-dependencies group with 6 updates:

Package	From	To
@tauri-apps/api	2.12.0	2.12.3
@tauri-apps/plugin-fs	2.6.0	2.7.0
@tauri-apps/plugin-opener	2.6.0	2.7.1
@thesvg/react	3.3.9	3.3.13
react-syntax-highlighter	16.1.1	16.1.2
react-virtuoso	4.18.15	4.18.16

Updates @tauri-apps/api from 2.12.0 to 2.12.3

Release notes

Sourced from @​tauri-apps/api's releases.

@​tauri-apps/api v2.12.3

All found vulnerabilities were already reviewed and decided to be ignored
3 ignored: 3 high

[2.12.3]

Bug Fixes

• 0204f6f3a (#16244) Keep delivering Channel messages after the onmessage handler throws. The error is rethrown asynchronously so it is still reported as uncaught, instead of leaving every later message queued.

$ pnpm build && cd ./dist && pnpm publish --access public --loglevel debug --no-git-checks
$ rollup -c --configPlugin typescript
�[36m
�[1m./src/app.ts, ./src/core.ts, ./src/dpi.ts, ./src/event.ts, ./src/image.ts, ./src/index.ts, ./src/menu.ts, ./src/mocks.ts, ./src/path.ts, ./src/tray.ts, ./src/webview.ts, ./src/webviewWindow.ts, ./src/window.ts�[22m → �[1m./dist, ./dist�[22m...�[39m
�[32mcreated �[1m./dist, ./dist�[22m in �[1m911ms�[22m�[39m
�[36m
�[1msrc/index.ts�[22m → �[1m../../crates/tauri/scripts/bundle.global.js�[22m...�[39m
�[32mcreated �[1m../../crates/tauri/scripts/bundle.global.js�[22m in �[1m1.3s�[22m�[39m
GET https://run-actions-3-azure-eastus.actions.githubusercontent.com/173//idtoken/7aa7f391-8187-8dab-bf55-bf43b72d0bd0/62377c8c-1199-5374-9168-2a108b628dd5?api-version=2.0&audience=npm%3Aregistry.npmjs.org 200 239ms
📦 @tauri-apps/api@2.12.3 → https://registry.npmjs.org/
GET https://run-actions-3-azure-eastus.actions.githubusercontent.com/173//idtoken/7aa7f391-8187-8dab-bf55-bf43b72d0bd0/62377c8c-1199-5374-9168-2a108b628dd5?api-version=2.0&audience=sigstore 200 81ms
Signed provenance statement with source and build information
✅ Published package @tauri-apps/api@2.12.3

@​tauri-apps/api v2.12.2

All found vulnerabilities were already reviewed and decided to be ignored
3 ignored: 3 high

[2.12.2]

... (truncated)

Commits

• 5b23c82 apply version updates (#16243)
• 05354a8 chore(deps): update swift-rs to 1.0.9
• c48e1ca fix(ios): make @_cdecl entry points public so release builds link on Xcode ...
• eeeaa0f fix(nsis): block downgrades in silent, passive and update modes (#16230)
• 0204f6f fix(api): keep Channel messages flowing after the handler throws (#16244)
• 7fcd8a7 fix(ci): retry switching to the Android webview context in e2e (#16239)
• fd319dd chore(deps): update base64 to 0.23
• 413cbdb Apply Version Updates From Current Changes (#16213)
• 587ae48 chore: disable CODEOWNERS file (#16236)
• a98038e fix: menu append doesn't take options like MenuItemOptions (#16235)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-fs from 2.6.0 to 2.7.0

Release notes

Sourced from @​tauri-apps/plugin-fs's releases.

fs-js v2.7.0

[2.7.0]

• a934743b (#3637) Added the scopeDroppedPaths plugin config option (plugins > fs > scopeDroppedPaths in tauri.conf.json). Set it to false to stop adding the paths dropped onto any window to the fs scope, which otherwise gives every webview with an fs permission access to them (directories recursively). Defaults to true, the current behaviour.
• 085a0283 (#3636) Fixed a panic on Android when a content provider returns no file descriptor for a content:// URI (e.g. virtual files). The fs command now fails with an error instead.
• f81f0447 (#3635) Fixed reading uncompressed Android assets ($RESOURCE files such as images or audio that are stored uncompressed in the APK) returning the bytes of the APK instead of the asset. Assets are now always read from a copy in the app cache, like compressed ones.
• e03dca60 (#3628) startAccessingSecurityScopedResource and stopAccessingSecurityScopedResource now accept absolute paths on iOS, as documented, instead of silently doing nothing unless given a file:// URL.
• 5de7ebfc (#3634) Security: the open command no longer accepts a customFlags option from the webview. It was not part of the JavaScript types and let the webview pass arbitrary open(2) flags (e.g. O_TRUNC) to files it may only read. OpenOptionsExt::custom_flags still works from Rust.
• 5e6c023a (#3626) FileHandle.read no longer allocates a buffer of the requested size up front: the length is capped to the rest of the file (64 MiB for files of unknown size), an allocation failure is reported as an error instead of aborting the app, and only the bytes that were read are sent back to the webview.
• 3a900017 (#3627) Security: the fs scope check now resolves symlinks in the ancestors of paths that do not exist yet, and resolves relative symlink targets against the link's directory instead of the process working directory. Previously a new file created below a symlinked directory inside the scope (writeFile, mkdir, create, rename, copyFile, ...) was written outside of the scope. Deny patterns now also apply to the path as given, so they can name a symlink, and a path whose symlinks cannot be resolved (e.g. a loop) is rejected.
• 77d00a4f (#3633) FileHandle.seek now rejects a negative offset with SeekMode.Start instead of seeking to a huge position.
• 5c144e74 (#3631) Fixed readTextFileLines with a UTF-16 encoding splitting lines on a 0x0A 0x00 (LE) or 0x00 0x0A (BE) byte sequence that is not aligned on a code unit, e.g. ਗĀ, which garbled every following line.
• dcc8cb03 (#3629) Fixed writeFile with a ReadableStream leaving the end of the previous contents in place when the new data is shorter. The file is now truncated first unless append is set, like when writing a buffer.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-fs@2.7.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 2.4kB README.md
npm notice 39.9kB dist-js/index.cjs
npm notice 41.1kB dist-js/index.d.ts
npm notice 39.2kB dist-js/index.js
npm notice 697B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-fs
npm notice version: 2.7.0
npm notice filename: tauri-apps-plugin-fs-2.7.0.tgz
npm notice package size: 25.6 kB
npm notice unpacked size: 124.3 kB
npm notice shasum: e76d4d07b05063de6911fd1c42948ab0264ac20e
npm notice integrity: sha512-8RQbPkuYuLZ2r[...]GdKJVqDokyDgQ==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189606635
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-fs@2.7.0

... (truncated)

Commits

• 6bbd44d publish new versions (#3675)
• fc18d05 fix(global-shortcut): release the shortcuts lock before running handlers (#3683)
• 42ae8b4 fix(ios): make init_plugin_* entry points public so release builds link on ...
• 818d2e0 fix(single-instance): limit second instance's wait on Windows (#3645)
• 323fe80 fix(single-instance): forward non-Unicode arguments and cwd (#3644)
• 6772581 test(e2e): fix __name usage on FS test
• 46f7c87 chore: fmt
• a8acd17 feat(shell): add process group spawn option (fix #1332) (#3351)
• e03dca6 fix(fs): accept absolute paths in the iOS security-scope commands (#3628)
• 3a90001 fix(fs): resolve symlinks of missing paths before checking the scope (#3627)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-opener from 2.6.0 to 2.7.1

Release notes

Sourced from @​tauri-apps/plugin-opener's releases.

opener-js v2.7.1

[2.7.1]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-opener@2.7.1
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 3.1kB dist-js/index.cjs
npm notice 2.0kB dist-js/index.d.ts
npm notice 3.1kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 730B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-opener
npm notice version: 2.7.1
npm notice filename: tauri-apps-plugin-opener-2.7.1.tgz
npm notice package size: 3.5 kB
npm notice unpacked size: 14.1 kB
npm notice shasum: e8719fb7c89a681460f6b5b42a6b7d71746b4c92
npm notice integrity: sha512-XkXdt30rontti[...]F1sFsmu6uyywQ==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189619091
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-opener@2.7.1

opener v2.7.1

[2.7.1]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

... (truncated)

Commits

• 44293a5 Publish New Versions (v2) (#3689)
• 7550f7c chore(deps): bump rustls to 0.23.46
• 36d8e40 feat(geolocation): support for non-GMS devices (#3377)
• 57297f3 feat(clipboard-manager): add support for writing secrets (#3376)
• 1ab9304 fix(opener): avoid blocking-runtime panic in reveal_item_in_dir (#3565)
• 0e17675 fix(http): decode header values as ISO-8859-1 (#3586)
• 62b3565 chore(deps): update quinn-proto (lockfile-only) (#3707)
• d80b1be feat: add torch plugin for iOS and Android (#3551)
• c91a9e6 feat(sql): add autoCreate option to Database.load (#3702)
• 0374bec [feat] [biometric] Adding the capability of encrypting/decrypting data using ...
• Additional commits viewable in compare view

Updates @thesvg/react from 3.3.9 to 3.3.13

Changelog

Sourced from @​thesvg/react's changelog.

3.3.13

Patch Changes

• feat: add easypanel, fivetran and other requested icons (#1279)

3.3.12

Patch Changes

• #1210 c17e015 Thanks @​OmShiv! - Add the missing viewBox to 229 icon SVGs

  The React, React Native, Vue and Svelte components fall back to viewBox "0 0 24 24" when an SVG has none, so 15 logos drawn on larger canvases (Amazon, Amazon Music, BBC, Best Buy, Citibank, Disney and others) rendered cropped or as a solid block. All 229 affected SVGs, including 214 GCP icons, also failed to scale when the raw svg string was sized with CSS.

3.3.11

Patch Changes

• fix: drop terms-of-sale link from tintas-vital guidelines (#1200)

3.3.10

Patch Changes

• feat: add tintas-vital icon (#1190)

Commits

• a0da727 chore(release): version packages (#1243)
• 37d140a chore(release): version packages (#1215)
• c011b34 chore(release): version packages (#1203)
• fde307d chore(release): version packages (#1193)
• d8747c3 chore(deps-dev): bump the development-minor-patch group with 4 updates (#1173)
• 6c60f21 chore(release): version packages (#1145)
• 75da0d8 chore: land reviewed PRs, add dawarich icon and nowly light/dark variants
• See full diff in compare view

Updates react-syntax-highlighter from 16.1.1 to 16.1.2

Release notes

Sourced from react-syntax-highlighter's releases.

v16.1.2

What's Changed

• fix: ESM still missing .js with highlight.js by @​Ronny-zzl in react-syntax-highlighter/react-syntax-highlighter#635

New Contributors

• @​Ronny-zzl made their first contribution in react-syntax-highlighter/react-syntax-highlighter#635

Full Changelog: react-syntax-highlighter/react-syntax-highlighter@v16.1.1...v16.1.2

Commits

• 26dbd6c version bump to 16.1.2
• 0c5da9e fix: ESM still missing .js with highlight.js (#635)
• See full diff in compare view

Updates react-virtuoso from 4.18.15 to 4.18.16

Release notes

Sourced from react-virtuoso's releases.

react-virtuoso@4.18.16

Patch Changes

• #1512 b7238f3 Thanks @​cpruijsen! - Map skipAnimationFrameInResizeObserver through TableVirtuoso's urx optional props so the table resize observer consumes it instead of leaving the leftover prop on the scroller DOM.

Changelog

Sourced from react-virtuoso's changelog.

4.18.16

Patch Changes

• #1512 b7238f3 Thanks @​cpruijsen! - Map skipAnimationFrameInResizeObserver through TableVirtuoso's urx optional props so the table resize observer consumes it instead of leaving the leftover prop on the scroller DOM.

Commits

• 6650ec4 Version Packages (#1515)
• b7238f3 fix: map skipAnimationFrameInResizeObserver on TableVirtuoso (#1512)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.