[dependabot]

Bumps the routine-updates group with 13 updates in the / directory:

Package	From	To
serde_json	1.0.151	1.0.154
thiserror	2.0.20	2.0.21
tokio	1.53.1	1.53.3
interprocess	2.4.4	2.4.5
libc	0.2.189	0.2.190
tauri	2.11.5	2.11.6
tauri-plugin-opener	2.5.5	2.7.1
tauri-plugin-dialog	2.7.3	2.8.2
tauri-plugin-notification	2.4.0	2.6.0
tauri-plugin-process	2.3.1	2.4.0
tauri-plugin-single-instance	2.4.4	2.5.3
dns-lookup	4.0.1	4.0.2
tauri-build	2.6.3	2.7.3

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

• Support preserve_order in no_std builds (#1333, thanks @​razmser)

v1.0.153

• Report invalid UTF-8 at the first bad byte (#1345, thanks @​00200200)

v1.0.152

• Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @​yuxi-liu-wired)

Commits

• 20572a6 Release 1.0.154
• a91bfaf Fix RandomState links in map documentation
• 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
• 4b2d726 Release 1.0.153
• 83335ee Touch up PR 1345
• 4b4810a Resolve range_plus_one pedantic clippy lint
• 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
• 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
• c9f1e3b Release 1.0.152
• 854fc70 Touch up PR 1347
• Additional commits viewable in compare view

Updates thiserror from 2.0.20 to 2.0.21

Release notes

Sourced from thiserror's releases.

2.0.21

• Fix parsing of generic unit variants in display expressions (#459)

Commits

• b1827ee Release 2.0.21
• 58037b5 Merge pull request #459 from dtolnay/turbofish
• f82a0cf Keep track of nested turbofish depth
• 72ea492 Raise required compiler to Rust 1.77
• 72eea0d Resolve io_other_error clippy lint in tests
• 07f09a2 Raise required compiler to Rust 1.74
• 2715388 Update ui test suite to nightly-2026-09-22
• 5a306c7 Update ui test suite to nightly-2026-09-05
• ef9383b Update ui test suite to nightly-2026-08-22
• 8336b84 Update ui tests for version 2.0.20
• See full diff in compare view

Updates tokio from 1.53.1 to 1.53.3

Release notes

Sourced from tokio's releases.

Tokio v1.53.3

1.53.3 (October 13th, 2026)

Added

• io: add AsyncFd::register and AsyncFd::register_with_interest (#8587)

Changed

• io: deprecate AsyncFd::{new, with_interest, try_new, try_with_interest} (#8587)

Fixed

• io: wake and drop DuplexStream wakers outside the lock (#8618)
• macros: avoid unreachable_code in join! and try_join! for Infallible (#8518)
• runtime: fix paused time auto-advancing when I/O wakes a task on current_thread (#8595)
• sync: wake waiters outside the lock when closing a semaphore (#8529)
• test: fix several flaky tests (#8196, #8427, #8609)

Fixed (unstable)

• rt: keep io_uring op alive when submission fails after push (#8185)

#8185: tokio-rs/tokio#8185 #8196: tokio-rs/tokio#8196 #8427: tokio-rs/tokio#8427 #8518: tokio-rs/tokio#8518 #8529: tokio-rs/tokio#8529 #8587: tokio-rs/tokio#8587 #8595: tokio-rs/tokio#8595 #8609: tokio-rs/tokio#8609 #8618: tokio-rs/tokio#8618

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

• fs: handle integer overflow in buffered relative seek (#8574)
• io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• process: unregister Windows wait before closing child handle (#8564)
• rt: drop blocking pool mutex before shutting down rejected task (#8562)
• sync: fix mpsc index wraparound in block reclamation (#8546)
• sync: forget mpsc Permit before sending value (#8560)
• sync: validate MAX_PERMITS in Semaphore::acquire (#8548)
• sync: wake broadcast Sender::closed outside mutex (#8558)
• task: drop replaced waker outside lock in JoinSet (#8554)
• time: drop timer lock before dropping waker in clear_entry (#8552)
• time: expire timers directly on shutdown without rotating wheel (#8570)

... (truncated)

Commits

• a85c3f5 chore: prepare Tokio v1.53.3 (#8639)
• df4443e Merge 'tokio-1.51.6' into 'tokio-1.53.x' (#8638)
• f00b2e6 chore: prepare Tokio v1.51.6 (#8637)
• 482eadd runtime: record time wake when unparking tasks on current thread (#8595)
• 55fbab7 io: wake and drop DuplexStream wakers outside the lock (#8618)
• c5e4d9e runtime: keep io_uring op alive when submission fails after push (#8185)
• 0448618 sync: make tracing_sync tests synchronous (#8427)
• 2bc1146 net: accept ConnectionReset in shutdown_after_tcp_reset test (#8196)
• bb28a94 Merge 'tokio-1.51.x' into 'tokio-1.53.x' (#8624)
• 6b97913 macros: avoid unreachable_code in join! and try_join! for Infallible ...
• Additional commits viewable in compare view

Updates interprocess from 2.4.4 to 2.4.5

Release notes

Sourced from interprocess's releases.

2.4.5

• PeerCreds has been improved on xucred platforms (FreeBSD, Dragonfly BSD, Apple platforms):
  • With a correction of a misunderstanding of the meaning of cr_groups, egid now returns Some and groups no longer includes the EGID twice.
  • The level of detail of the safety comments has been increased in preparation for upstreaming a version of PeerCreds into the standard library.
• PeerCreds now has a method groups_truncated for checking if the groups returned by groups are not the full set of supplementary groups due to platform limitations.

Commits

• 5822593 chore: bump version
• 5b99120 fix: deal with Clippy regression
• b6f13f7 fix: xucred adjustments
• f44bbb1 chore: more meticulous and flexible getsockopt
• 2a958a0 chore: some new miscellanea
• See full diff in compare view

Updates libc from 0.2.189 to 0.2.190

Release notes

Sourced from libc's releases.

0.2.190

There is now a single config for enabling 64-bit time_t: libc_unstable_time64. This can be set unconditionally; it opts in to 64-bit time_t on the following platforms that use 32-bit by default:

• 32-bit Linux-GNU
• 32-bit Linux-uClibc
• 32-bit Linux-musl. Note that setting this flag also enables some other changes that happend in musl v1.2.
• 32-bit Windows-GNU
• ESP-IDF (all targets with this environment are 32-bit)

Most other 32-bit platforms are either already using 64-bit time_t, or are considered legacy and will not be gaining support from their upstream maintainers.

You can enable this using RUSTFLAGS:

RUSTFLAGS='--cfg=libc_unstable_time64' cargo ...

Note that there may still be some changes to features gated by this config option, hence "unstable" in its name. In the near future we will rename it to just libc_time64. Until then, please test it out and report any bugs you find!

Support

• Add initial support for HelenOS (#4355)

Added

We are slowly filling out the Default implementations, to reduce the need for mem::zeroed() in user code:

• Unix: Implement Default for a number of structs, especially on Apple platforms (#5576)
• Linux, NetBSD: Give statvfs a Default impl (#5583)
• Linux: Add Default to a linux/can.rs structs (#5257)

Other additions:

• Expose the libc_unstable_time64 cfg (#5411)
• Android, Glibc: Add pthread_gettid_np (#5359)
• Android: Add RTLD_NEXT (#5323)
• Android: Add reuseport BPF socket options (#5366)
• Apple: Add TCP header flags, options and SACK limits (#5358)
• Apple: Add NET_RT_DUMP2 (#5442)
• Apple: Add posix_spawn_file_actions_add(f)chdir(_np) (#5558)
• BSD: Add BPF_WORDALIGN (#5320)
• BSD: Add lchmod and lchflags where supported (#5400)
• BSD: Add minherit and related constants (#4849)
• Docs: Add more links to public headers and manual pages (#5407), (#5485)

... (truncated)

Changelog

Sourced from libc's changelog.

0.2.190 - 2026-10-02

There is now a single config for enabling 64-bit time_t: libc_unstable_time64. This can be set unconditionally; it opts in to 64-bit time_t on the following platforms that use 32-bit by default:

• 32-bit Linux-GNU
• 32-bit Linux-uClibc
• 32-bit Linux-musl. Note that setting this flag also enables some other changes that happend in musl v1.2.
• 32-bit Windows-GNU
• ESP-IDF (all targets with this environment are 32-bit)

Most other 32-bit platforms are either already using 64-bit time_t, or are considered legacy and will not be gaining support from their upstream maintainers.

You can enable this using RUSTFLAGS:

RUSTFLAGS='--cfg=libc_unstable_time64' cargo ...

Note that there may still be some changes to features gated by this config option, hence "unstable" in its name. In the near future we will rename it to just libc_time64. Until then, please test it out and report any bugs you find!

Support

• Add initial support for HelenOS (#4355)

Added

We are slowly filling out the Default implementations, to reduce the need for mem::zeroed() in user code:

• Unix: Implement Default for a number of structs, especially on Apple platforms (#5576)
• Linux, NetBSD: Give statvfs a Default impl (#5583)
• Linux: Add Default to a linux/can.rs structs (#5257)

Other additions:

• Expose the libc_unstable_time64 cfg (#5411)
• Android, Glibc: Add pthread_gettid_np (#5359)
• Android: Add RTLD_NEXT (#5323)
• Android: Add reuseport BPF socket options (#5366)
• Apple: Add TCP header flags, options and SACK limits (#5358)
• Apple: Add NET_RT_DUMP2 (#5442)
• Apple: Add posix_spawn_file_actions_add(f)chdir(_np) (#5558)
• BSD: Add BPF_WORDALIGN (#5320)
• BSD: Add lchmod and lchflags where supported (#5400)
• BSD: Add minherit and related constants (#4849)

... (truncated)

Commits

• 7b0ab55 ci: Rename publish_0.2.yml to release.yaml
• ac85dde ci: Sync release permissions with main
• 8f8cd20 libc: Release 0.2.190
• 052c6e6 changelog: Fix an incorrect commit link
• ea19fd7 test: Remove explicit libc version
• 6dbf3a2 dragonfly: Move INHERIT_ZERO to the freebsd module
• 8a64766 apple: add posix_spawn_file_actions_add(f)chdir(_np)
• 28de514 linux, netbsd: Give statvfs a Default impl
• a58a95f cygwin: Change POSIX_SPAWN_* flags to c_short
• d175264 apple: timeval32 is exhaustive
• Additional commits viewable in compare view

Updates tauri from 2.11.5 to 2.11.6

Commits

• 9452dde fix audit
• 7c2fe9f run covector version
• 7d71a8a add publish-hotfix workflow
• 5a87bab Merge commit from fork
• e901f1d Merge commit from fork
• See full diff in compare view

Updates tauri-plugin-opener from 2.5.5 to 2.7.1

Release notes

Sourced from tauri-plugin-opener's releases.

opener-js v2.7.1

[2.7.1]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-opener@2.7.1
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 3.1kB dist-js/index.cjs
npm notice 2.0kB dist-js/index.d.ts
npm notice 3.1kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 730B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-opener
npm notice version: 2.7.1
npm notice filename: tauri-apps-plugin-opener-2.7.1.tgz
npm notice package size: 3.5 kB
npm notice unpacked size: 14.1 kB
npm notice shasum: e8719fb7c89a681460f6b5b42a6b7d71746b4c92
npm notice integrity: sha512-XkXdt30rontti[...]F1sFsmu6uyywQ==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189619091
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-opener@2.7.1

opener v2.7.1

[2.7.1]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

... (truncated)

Commits

• 44293a5 Publish New Versions (v2) (#3689)
• 7550f7c chore(deps): bump rustls to 0.23.46
• 36d8e40 feat(geolocation): support for non-GMS devices (#3377)
• 57297f3 feat(clipboard-manager): add support for writing secrets (#3376)
• 1ab9304 fix(opener): avoid blocking-runtime panic in reveal_item_in_dir (#3565)
• 0e17675 fix(http): decode header values as ISO-8859-1 (#3586)
• 62b3565 chore(deps): update quinn-proto (lockfile-only) (#3707)
• d80b1be feat: add torch plugin for iOS and Android (#3551)
• c91a9e6 feat(sql): add autoCreate option to Database.load (#3702)
• 0374bec [feat] [biometric] Adding the capability of encrypting/decrypting data using ...
• Additional commits viewable in compare view

Updates tauri-plugin-dialog from 2.7.3 to 2.8.2

Release notes

Sourced from tauri-plugin-dialog's releases.

http-js v2.8.2

[2.8.2]

Dependencies

• Upgraded to fs-js@2.7.0

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-http@2.8.2
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 2.6kB README.md
npm notice 7.7kB dist-js/index.cjs
npm notice 3.4kB dist-js/index.d.ts
npm notice 7.7kB dist-js/index.js
npm notice 655B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-http
npm notice version: 2.8.2
npm notice filename: tauri-apps-plugin-http-2.8.2.tgz
npm notice package size: 5.5 kB
npm notice unpacked size: 23.0 kB
npm notice shasum: 2c9d8f56a25f10bcf19fc3ceca2acd40457487b2
npm notice integrity: sha512-xVHnZdIkPY9+/[...]BWzSjWEVAvvUA==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189625257
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-http@2.8.2

http v2.8.2

[2.8.2]

Dependencies

• Upgraded to fs-js@2.7.0

... (truncated)

Commits

• 6bbd44d publish new versions (#3675)
• fc18d05 fix(global-shortcut): release the shortcuts lock before running handlers (#3683)
• 42ae8b4 fix(ios): make init_plugin_* entry points public so release builds link on ...
• 818d2e0 fix(single-instance): limit second instance's wait on Windows (#3645)
• 323fe80 fix(single-instance): forward non-Unicode arguments and cwd (#3644)
• 6772581 test(e2e): fix __name usage on FS test
• 46f7c87 chore: fmt
• a8acd17 feat(shell): add process group spawn option (fix #1332) (#3351)
• e03dca6 fix(fs): accept absolute paths in the iOS security-scope commands (#3628)
• 3a90001 fix(fs): resolve symlinks of missing paths before checking the scope (#3627)
• Additional commits viewable in compare view

Updates tauri-plugin-notification from 2.4.0 to 2.6.0

Release notes

Sourced from tauri-plugin-notification's releases.

notification-js v2.6.0

[2.6.0]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

feat

• 46381516 (#3671) Report actions on desktop: a click on a notification (tap) or on one of the actions of its action type reaches onAction and the new Rust Notification::on_action, which also works on mobile. registerActionTypes, removeActive (Linux and the BSDs) and the listener commands no longer fail with "command not found" on desktop.

  The onAction callback is now typed with the new ActionPerformed interface, which is what every platform sends, instead of Options. Callbacks annotated with Options must be updated.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-notification@2.6.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 16.6kB dist-js/index.cjs
npm notice 26.1kB dist-js/index.d.ts
npm notice 16.2kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 663B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-notification
npm notice version: 2.6.0
npm notice filename: tauri-apps-plugin-notification-2.6.0.tgz
npm notice package size: 11.1 kB
npm notice unpacked size: 64.7 kB
npm notice shasum: 68f6090e06e17a92fd1803c7b40a01e4ee20cc7c
npm notice integrity: sha512-QvpsQ6L6uSGT/[...]J3c52S+1afsIw==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189634908
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-notification@2.6.0

notification v2.6.0

... (truncated)

Commits

• See full diff in compare view

Updates tauri-plugin-process from 2.3.1 to 2.4.0

Commits

• a2364a5 fix: integration test
• 67ebc13 fix(ci): check-publish job should check .changes/pre.json
• cbfd428 Publish New Versions (v2) (#3618)
• f460570 chore: fmt
• a433ec0 fix: mobile clippy warnings
• 3d8a3c8 chore: edition 2024
• b517cc7 fix: actually set rust-version to 1.90
• b6a38a5 fix(ci): e2e test error reporting
• 9b29b60 feat: update to tauri 2.12
• 3a01943 tests(e2e): fix e2e failures on Linux and Windows (#3642)
• Additional commits viewable in compare view

Updates tauri-plugin-single-instance from 2.4.4 to 2.5.3

Release notes

Sourced from tauri-plugin-single-instance's releases.

single-instance v2.5.3

[2.5.3]

• 818d2e04 (#3645) On Windows, a second instance no longer waits indefinitely for a first instance that stopped processing messages: it stops waiting after 10 seconds and exits. The first instance may still receive the arguments once it resumes processing messages.
• 323fe80d (#3644) A second instance no longer panics when a command-line argument is not valid Unicode: such an argument is forwarded with its invalid parts replaced by U+FFFD. A working directory that is not valid Unicode is now forwarded the same way instead of as an empty string.

Updating crates.io index
   Packaging tauri-plugin-single-instance v2.5.3 (/home/runner/work/plugins-workspace/plugins-workspace/plugins/single-instance)
    Updating crates.io index
warning: package `yoke-derive v0.8.3` in Cargo.lock is yanked in registry `crates-io`
  |
  = help: consider updating to a version that is not yanked
    Packaged 15 files, 170.3KiB (46.5KiB compressed)
   Uploading tauri-plugin-single-instance v2.5.3 (/home/runner/work/plugins-workspace/plugins-workspace/plugins/single-instance)
    Uploaded tauri-plugin-single-instance v2.5.3 to registry `crates-io`
note: waiting for tauri-plugin-single-instance v2.5.3 to be available at registry `crates-io`
help: you may press ctrl-c to skip waiting; the crate should be available shortly
   Published tauri-plugin-single-instance v2.5.3 at registry `crates-io`

barcode-scanner-js v2.5.3

[2.5.3]

• d80b1be2 (#3551 by @​bizkda) On Android, expose the camera bound by an active scan so the torch plugin can turn the flash on and off during a scan.
• b3e52ce0 (#3571 by @​ghostshreyash) Fix cancel() on Android leaving the pending scan() promise unsettled: destroy() cleared the saved invoke before it was rejected, so the "cancelled" rejection never reached the caller. The pending scan is now rejected before the camera is torn down, matching iOS.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-barcode-scanner@2.5.3
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.3kB README.md
npm notice 5.3kB dist-js/index.cjs
npm notice 5.3kB dist-js/index.d.ts
npm notice 5.2kB dist-js/index.js
npm notice 755B package.json
npm notice Tarball Details
</tr></table> 

... (truncated)

Commits

• 650ff5f chore(deps): update dependency typescript-eslint to v8.44.0 (#2988)
• 2930aa3 chore: set minimumReleaseAge to 3 days in renovate and pnpm (#2999)
• 3e92ce2 fix(geolocation): remove logging of priority (#3002)
• 12da195 chore(deps): update dependency rollup to v4.50.1 (#2986)
• See full diff in compare view

Updates dns-lookup from 4.0.1 to 4.0.2

Commits

• 75872a9 Tag version 4.0.2
• 056bb60 Remove utils crate
• 3461ea5 Fix haiku support
• 169b3ae Merge pull request #59 from xtqqczze/docs-badge
• 38bf814 Merge pull request #60 from xtqqczze/docs-rs
• 531ec65 Merge pull request #57 from xtqqczze/target-wasi
• 4deb442 Generate documention for Tier 1 targets
• 2ba6518 Add docs.rs badge
• 9e73a24 Fix build failure on wasi
• 978f20c Merge pull request #56 from xtqqczze/target-haiku
• Additional commits viewable in compare view

Updates tauri-build from 2.6.3 to 2.7.3

Release notes

Sourced from tauri-build's releases.

tauri-build v2.7.3

Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1314 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (1045 crate dependencies)
Crate:     fxhash
Version:   0.2.1
Warning:   unmaintained
Title:     fxhash - no longer maintained
Date:      2025-09-05
ID:        RUSTSEC-2025-0057
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0057
Crate:     paste
Version:   1.0.15
Warning:   unmaintained
Title:     paste - no longer maintained
Date:      2024-10-07
ID:        RUSTSEC-2024-0436
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0436
Crate:     rustybuzz
Version:   0.20.1
Warning:   unmaintained
Title:     rustybuzz is unmaintained
Date:      2026-07-11
ID:        RUSTSEC-2026-0206
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0206
Crate:     ttf-parser
Version:   0.25.1
Warning:   unmaintained
Title:     ttf-parser is unmaintained
Date:      2026-06-28
ID:        RUSTSEC-2026-0192
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0192
warning: 4 allowed warnings found

[2.7.3]

Enhancements

... (truncated)

Commits

• 59b63ab Apply Version Updates From Current Changes (#16255)
• 55883af fix(bundler): Update rpm-rs to 0.30 (#15639)
• 744ff2b chore(deps): bump rustls to 0.23.46
• c95be46 fix(cli): xcode-script tauri CWD rewrite (#16287)
• dc637db chore: add missing api change file (#16260)
• b948762 fix(macos-sign): import the signing certificate as an explicit pkcs12 (fix: #...
• 7b673dd fix(core): drop late mobile plugin responses instead of panicking (#16146)
• 5a61498 fix(bundler): keep script stderr in errors and hint at the Finder permission ...
• 5a3cbfc fix(macos-codesign): Inline apple-codesign code (#16279)
• 141d1c0 fix(acl): resolve permission files after the target dir is moved (#16199)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions