chore(deps): bump the rust group across 1 directory with 9 updates

[dependabot]

Bumps the rust group with 9 updates in the / directory:

Package	From	To
serde_json	1.0.151	1.0.154
thiserror	2.0.20	2.0.21
tauri-plugin-clipboard-manager	2.3.3	2.4.2
tauri-plugin-dialog	2.7.3	2.8.2
tauri-plugin-global-shortcut	2.3.2	2.4.1
tauri-plugin-opener	2.5.5	2.7.1
tauri-plugin-updater	2.12.0	2.13.3
zip	4.6.1	8.6.0
tauri-build	2.6.3	2.7.3

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

• Support preserve_order in no_std builds (#1333, thanks @​razmser)

v1.0.153

• Report invalid UTF-8 at the first bad byte (#1345, thanks @​00200200)

v1.0.152

• Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @​yuxi-liu-wired)

Commits

• 20572a6 Release 1.0.154
• a91bfaf Fix RandomState links in map documentation
• 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
• 4b2d726 Release 1.0.153
• 83335ee Touch up PR 1345
• 4b4810a Resolve range_plus_one pedantic clippy lint
• 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
• 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
• c9f1e3b Release 1.0.152
• 854fc70 Touch up PR 1347
• Additional commits viewable in compare view

Updates thiserror from 2.0.20 to 2.0.21

Release notes

Sourced from thiserror's releases.

2.0.21

• Fix parsing of generic unit variants in display expressions (#459)

Commits

• b1827ee Release 2.0.21
• 58037b5 Merge pull request #459 from dtolnay/turbofish
• f82a0cf Keep track of nested turbofish depth
• 72ea492 Raise required compiler to Rust 1.77
• 72eea0d Resolve io_other_error clippy lint in tests
• 07f09a2 Raise required compiler to Rust 1.74
• 2715388 Update ui test suite to nightly-2026-09-22
• 5a306c7 Update ui test suite to nightly-2026-09-05
• ef9383b Update ui test suite to nightly-2026-08-22
• 8336b84 Update ui tests for version 2.0.20
• See full diff in compare view

Updates tauri-plugin-clipboard-manager from 2.3.3 to 2.4.2

Release notes

Sourced from tauri-plugin-clipboard-manager's releases.

geolocation-js v2.4.2

[2.4.2]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-geolocation@2.4.2
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.8kB README.md
npm notice 3.9kB dist-js/index.cjs
npm notice 6.3kB dist-js/index.d.ts
npm notice 3.7kB dist-js/index.js
npm notice 662B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-geolocation
npm notice version: 2.4.2
npm notice filename: tauri-apps-plugin-geolocation-2.4.2.tgz
npm notice package size: 4.8 kB
npm notice unpacked size: 20.2 kB
npm notice shasum: 6d73ce4b1a0c3ffa8f19a7294fe68fa1768fe6dd
npm notice integrity: sha512-JLuLHiAyXMu24[...]FMhrjZh89m88w==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189612489
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-geolocation@2.4.2

geolocation v2.4.2

[2.4.2]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

... (truncated)

Commits

• 2371804 publish new versions (#2888)
• 90f9b93 chore: fix cli version in deep-link package.json
• 1c58f33 chore(deps): update dependency rollup to v4.46.4 (v2) (#2935)
• 75617a6 fix(mobile): deeplinks (#2870)
• 5a963a0 chore(deps): update dependency @​tauri-apps/cli to v2.8.1 (#2930)
• 76f4e7b chore(deps): update eslint monorepo to v9.33.0 (#2903)
• 670ac1d chore(deps): update dependency typescript-eslint to v8.40.0 (#2923)
• ed0deef chore(deps): update dependency @​tauri-apps/api to v2.8.0 (#2929)
• 50cebdb chore(deps): update to tauri 2.8.0 (#2925)
• dd2ea9c chore(deps): update dependency rollup to v4.46.3 (#2920)
• Additional commits viewable in compare view

Updates tauri-plugin-dialog from 2.7.3 to 2.8.2

Release notes

Sourced from tauri-plugin-dialog's releases.

http-js v2.8.2

[2.8.2]

Dependencies

• Upgraded to fs-js@2.7.0

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-http@2.8.2
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 2.6kB README.md
npm notice 7.7kB dist-js/index.cjs
npm notice 3.4kB dist-js/index.d.ts
npm notice 7.7kB dist-js/index.js
npm notice 655B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-http
npm notice version: 2.8.2
npm notice filename: tauri-apps-plugin-http-2.8.2.tgz
npm notice package size: 5.5 kB
npm notice unpacked size: 23.0 kB
npm notice shasum: 2c9d8f56a25f10bcf19fc3ceca2acd40457487b2
npm notice integrity: sha512-xVHnZdIkPY9+/[...]BWzSjWEVAvvUA==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189625257
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-http@2.8.2

http v2.8.2

[2.8.2]

Dependencies

• Upgraded to fs-js@2.7.0

... (truncated)

Commits

• 6bbd44d publish new versions (#3675)
• fc18d05 fix(global-shortcut): release the shortcuts lock before running handlers (#3683)
• 42ae8b4 fix(ios): make init_plugin_* entry points public so release builds link on ...
• 818d2e0 fix(single-instance): limit second instance's wait on Windows (#3645)
• 323fe80 fix(single-instance): forward non-Unicode arguments and cwd (#3644)
• 6772581 test(e2e): fix __name usage on FS test
• 46f7c87 chore: fmt
• a8acd17 feat(shell): add process group spawn option (fix #1332) (#3351)
• e03dca6 fix(fs): accept absolute paths in the iOS security-scope commands (#3628)
• 3a90001 fix(fs): resolve symlinks of missing paths before checking the scope (#3627)
• Additional commits viewable in compare view

Updates tauri-plugin-global-shortcut from 2.3.2 to 2.4.1

Release notes

Sourced from tauri-plugin-global-shortcut's releases.

global-shortcut-js v2.4.1

[2.4.1]

• fc18d055 (#3683) Release the shortcuts lock before running shortcut handlers, so a handler that calls back into the plugin, or pumps messages that dispatch another shortcut event, no longer deadlocks the app.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-global-shortcut@2.4.1
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.8kB README.md
npm notice 3.5kB dist-js/index.cjs
npm notice 3.3kB dist-js/index.d.ts
npm notice 3.4kB dist-js/index.js
npm notice 666B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-global-shortcut
npm notice version: 2.4.1
npm notice filename: tauri-apps-plugin-global-shortcut-2.4.1.tgz
npm notice package size: 3.7 kB
npm notice unpacked size: 15.6 kB
npm notice shasum: b5d53b422217eacf53ad630c586a8c3a72cd7d0e
npm notice integrity: sha512-NVCoQ0ShDFncs[...]lvVOG7tMr/e8g==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189615918
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-global-shortcut@2.4.1

global-shortcut v2.4.1

[2.4.1]

• fc18d055 (#3683) Release the shortcuts lock before running shortcut handlers, so a handler that calls back into the plugin, or pumps messages that dispatch another shortcut event, no longer deadlocks the app.

... (truncated)

Commits

• d66aa6f publish new versions (#2822)
• 6f34587 fix(single-instance): disable dbus name replacement (#2860)
• 708fa4e chore(deps): update dependency eslint-config-prettier to v10.1.8 (#2858)
• b729203 fix(upload): fix download() locks main thread on Android (#2838)
• 2f9c71a chore(deps): update dependency rollup to v4.45.1 (#2850)
• 80d4d8e chore(deps): update eslint monorepo to v9.31.0 (v2) (#2839)
• e7a98b0 chore(deps): update dependency typescript-eslint to v8.37.0 (#2848)
• 44a1f65 fix(fs): writeFile create file by default (#2846)
• 6210cd3 chore(deps): update dependency rollup to v4.45.0 (#2841)
• 467f07b chore(deps): update dependency vite to v7 (v2) (#2800)
• Additional commits viewable in compare view

Updates tauri-plugin-opener from 2.5.5 to 2.7.1

Release notes

Sourced from tauri-plugin-opener's releases.

opener-js v2.7.1

[2.7.1]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-opener@2.7.1
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 3.1kB dist-js/index.cjs
npm notice 2.0kB dist-js/index.d.ts
npm notice 3.1kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 730B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-opener
npm notice version: 2.7.1
npm notice filename: tauri-apps-plugin-opener-2.7.1.tgz
npm notice package size: 3.5 kB
npm notice unpacked size: 14.1 kB
npm notice shasum: e8719fb7c89a681460f6b5b42a6b7d71746b4c92
npm notice integrity: sha512-XkXdt30rontti[...]F1sFsmu6uyywQ==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189619091
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-opener@2.7.1

opener v2.7.1

[2.7.1]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

... (truncated)

Commits

• 44293a5 Publish New Versions (v2) (#3689)
• 7550f7c chore(deps): bump rustls to 0.23.46
• 36d8e40 feat(geolocation): support for non-GMS devices (#3377)
• 57297f3 feat(clipboard-manager): add support for writing secrets (#3376)
• 1ab9304 fix(opener): avoid blocking-runtime panic in reveal_item_in_dir (#3565)
• 0e17675 fix(http): decode header values as ISO-8859-1 (#3586)
• 62b3565 chore(deps): update quinn-proto (lockfile-only) (#3707)
• d80b1be feat: add torch plugin for iOS and Android (#3551)
• c91a9e6 feat(sql): add autoCreate option to Database.load (#3702)
• 0374bec [feat] [biometric] Adding the capability of encrypting/decrypting data using ...
• Additional commits viewable in compare view

Updates tauri-plugin-updater from 2.12.0 to 2.13.3

Release notes

Sourced from tauri-plugin-updater's releases.

updater-js v2.13.3

[2.13.3]

• 81631888 (#3658) Update minisign-verify to 0.3, which rejects signatures with a non-canonical Ed25519 S value. The Error::Minisign variant now wraps minisign_verify 0.3's Error, and its message reads like "The signature verification failed" instead of the variant name (InvalidSignature).

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-updater@2.13.3
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.2kB README.md
npm notice 6.7kB dist-js/index.cjs
npm notice 7.1kB dist-js/index.d.ts
npm notice 6.6kB dist-js/index.js
npm notice 659B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-updater
npm notice version: 2.13.3
npm notice filename: tauri-apps-plugin-updater-2.13.3.tgz
npm notice package size: 4.8 kB
npm notice unpacked size: 25.1 kB
npm notice shasum: fcd5b571631ca48f03eea01d6d1c0a0e776dc2f4
npm notice integrity: sha512-CtbA8CZ79WJry[...]/97ZjQ33dKUgg==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189642273
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-updater@2.13.3

updater v2.13.3

[2.13.3]

• 81631888 (#3658) Update minisign-verify to 0.3, which rejects signatures with a non-canonical Ed25519 S value. The Error::Minisign variant now wraps minisign_verify 0.3's Error, and its message reads like "The signature verification failed" instead of the variant name (InvalidSignature).

... (truncated)

Commits

• 6bbd44d publish new versions (#3675)
• fc18d05 fix(global-shortcut): release the shortcuts lock before running handlers (#3683)
• 42ae8b4 fix(ios): make init_plugin_* entry points public so release builds link on ...
• 818d2e0 fix(single-instance): limit second instance's wait on Windows (#3645)
• 323fe80 fix(single-instance): forward non-Unicode arguments and cwd (#3644)
• 6772581 test(e2e): fix __name usage on FS test
• 46f7c87 chore: fmt
• a8acd17 feat(shell): add process group spawn option (fix #1332) (#3351)
• e03dca6 fix(fs): accept absolute paths in the iOS security-scope commands (#3628)
• 3a90001 fix(fs): resolve symlinks of missing paths before checking the scope (#3627)
• Additional commits viewable in compare view

Updates zip from 4.6.1 to 8.6.0

Release notes

Sourced from zip's releases.

v8.6.0

🚀 Features

• add compression not supported as enum error (#774)

🐛 Bug Fixes

• allow for [u8] as filename (#775)

🚜 Refactor

• mark ZipFlags as non-exhaustive and add test for HasZipMetadata (#777)
• use and simplify is_dir (#776)

v8.5.1

🚜 Refactor

• change magic finder to stack buffer (#763)
• simplify extra field parsing (#764)

v8.5.0

🐛 Bug Fixes

• remove zip64 comment and add zip64 extensible data sector (#747)

🚜 Refactor

• remove useless magic in struct (#730)
• change extra_field from Arc<Vec> to Arc<[u8]> (#741)

⚙️ Miscellaneous Tasks

• cleanup README (#758)

v8.4.0

🚀 Features

• add a check for building benches (#748)

🚜 Refactor

• split part of read.rs for code readability (#744)
• remove unused allow (#745)

⚡ Performance

• skip BufReader for Stored files in make_reader (#739)

⚙️ Miscellaneous Tasks

... (truncated)

Changelog

Sourced from zip's changelog.

8.6.0 - 2026-04-25

🚀 Features

• add compression not supported as enum error (#774)

🐛 Bug Fixes

• allow for [u8] as filename (#775)

🚜 Refactor

• mark ZipFlags as non-exhaustive and add test for HasZipMetadata (#777)
• use and simplify is_dir (#776)

8.5.1 - 2026-04-06

🚜 Refactor

• change magic finder to stack buffer (#763)
• simplify extra field parsing (#764)

8.5.0 - 2026-04-01

🐛 Bug Fixes

• remove zip64 comment and add zip64 extensible data sector (#747)

🚜 Refactor

• remove useless magic in struct (#730)
• change extra_field from Arc<Vec> to Arc<[u8]> (#741)

⚙️ Miscellaneous Tasks

• cleanup README (#758)

8.4.0 - 2026-03-23

🚀 Features

• add a check for building benches (#748)

🚜 Refactor

• split part of read.rs for code readability (#744)
• remove unused allow (#745)

⚡ Performance

... (truncated)

Commits

• 771dfc5 chore: release v8.6.0 (#781)
• 8e480cc chore(deps): update sha1 requirement from 0.10 to 0.11 (#767)
• 2513bbe chore(deps): update aes requirement from 0.8 to 0.9 (#787)
• 957e240 ci(deps): bump actions/cache from 5.0.4 to 5.0.5 (#786)
• 0329d9d fix: allow for [u8] as filename (#775)
• ddcf854 ci(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#788)
• 42323a8 ci(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1 (#785)
• 901014a ci(deps): bump crate-ci/typos from 1.45.0 to 1.45.1 (#784)
• 07702d4 feat: add compression not supported as enum error (#774)
• 2d0c46b ci(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#783)
• Additional commits viewable in compare view

Updates tauri-build from 2.6.3 to 2.7.3

Release notes

Sourced from tauri-build's releases.

tauri-build v2.7.3

Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1314 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (1045 crate dependencies)
Crate:     fxhash
Version:   0.2.1
Warning:   unmaintained
Title:     fxhash - no longer maintained
Date:      2025-09-05
ID:        RUSTSEC-2025-0057
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0057
Crate:     paste
Version:   1.0.15
Warning:   unmaintained
Title:     paste - no longer maintained
Date:      2024-10-07
ID:        RUSTSEC-2024-0436
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0436
Crate:     rustybuzz
Version:   0.20.1
Warning:   unmaintained
Title:     rustybuzz is unmaintained
Date:      2026-07-11
ID:        RUSTSEC-2026-0206
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0206
Crate:     ttf-parser
Version:   0.25.1
Warning:   unmaintained
Title:     ttf-parser is unmaintained
Date:      2026-06-28
ID:        RUSTSEC-2026-0192
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0192
warning: 4 allowed warnings found

[2.7.3]

Enhancements

... (truncated)

Commits

• 59b63ab Apply Version Updates From Current Changes (#16255)
• 55883af fix(bundler): Update rpm-rs to 0.30 (#15639)
• 744ff2b chore(deps): bump rustls to 0.23.46
• c95be46 fix(cli): xcode-script tauri CWD rewrite (#16287)
• dc637db chore: add missing api change file (#16260)
• b948762 fix(macos-sign): import the signing certificate as an explicit pkcs12 (fix: #...
• 7b673dd fix(core): drop late mobile plugin responses instead of panicking (#16146)
• 5a61498 fix(bundler): keep script stderr in errors and hint at the Finder permission ...
• 5a3cbfc fix(macos-codesign): Inline apple-codesign code (#16279)
• 141d1c0 fix(acl): resolve permission files after the target dir is moved (#16199)
• Additional commits viewable in compare view