build(deps): batch ten dependency bumps into one review

[axpnet]

Ten dependency bumps in one branch, superseding #744 to #753.

crate, package or action	from	to	pull request
tauri-plugin-dialog	2.7.1	2.7.3	#751
tauri-plugin-log	2.9.0	2.9.1	#752
tauri-plugin-shell	2.3.5	2.3.6	#753
tokio-rustls	0.26.4	0.26.5	#748
@tauri-apps/plugin-dialog	2.7.2	2.7.3	#745
@tauri-apps/plugin-log	2.9.0	2.9.1	#750
@tauri-apps/plugin-shell	2.3.5	2.3.6	#746
autoprefixer	10.5.4	10.5.5	#747
postcss	8.5.26	8.5.28	#749
softprops/action-gh-release	3.0.2	3.0.3	#744

Why one branch instead of ten merges

Four touch only src-tauri/Cargo.lock and five touch only package.json and package-lock.json, so each merge makes its siblings stale and Dependabot rebases them in turn: nine rebases and several hundred check runs for changes that touch no source file in this repository. One branch runs the same gate once. This is the shape used for #687 and the reasoning has not changed.

What actually moved, read rather than assumed

tauri-plugin-dialog 2.7.3 also carries tauri-plugin-fs 1 patch forward, 2.5.1 to 2.5.2: they ship together and the dialog plugin depends on the file-system one. That is a fifth crate moving under four requested bumps, and the lock stays at 1189 packages, so it is a version change and not an addition.

autoprefixer 10.5.5 tightens its browserslist and caniuse-lite ranges, which pulls the browser-data chain forward with it: baseline-browser-mapping, browserslist, caniuse-lite, electron-to-chromium, node-releases and update-browserslist-db. These are data packages republished on a schedule rather than code changes, and the tree stays at 358 packages, so again nothing is added or removed.

postcss 8.5.28 tightens nanoid to ^3.3.18 and no nanoid version moves, because the tree was already on 3.3.18. Dependabot's own diff shows that line changing, which reads like a bump that then does not appear anywhere.

The action is the only change outside a lockfile, and it is pinned by commit SHA. A SHA pin is worth exactly the check that reads it, so both ends were dereferenced against the upstream repository: the SHA being replaced is the commit behind tag v3.0.2, and the one going in is the commit behind tag v3.0.3, an annotated tag in both cases, so the ref has to be resolved twice to reach the commit.

Not in this batch: quick-xml 0.41 to 0.42 (#754), which is an API break rather than a bump. Its elements now yield &str where the code passes &[u8], and Attribute::value is a Cow<str> rather than a Cow<[u8]>. It fails to compile with 163 errors spread over every one of the seven files that use the crate, counted from the check job's log rather than from the list of files that import it: jottacloud.rs 50, s3.rs 41, webdav.rs 30, azure.rs 24, xml_text.rs 19, sts.rs 19 and filezilla_import.rs 7. It stays open for the next release as a migration, not as a merge.

Verification

Local, on this branch: npm ci installs from this lock, tsc --noEmit is clean, 910 unit tests pass in 103 files, vite build succeeds, which is what actually exercises postcss and autoprefixer rather than merely installing them, i18n:validate reports zero placeholders, and cargo metadata --locked resolves the new Cargo.lock against Cargo.toml.

The Rust compile is this pull request's CI and is not claimed here. No source file is touched: the whole change is two lockfiles, three lines of package.json and two pinned SHAs in build.yml.

[coderabbitai]

Warning

Review limit reached

Next included review available in 46 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: a38fce87-90f7-48fd-8bf5-a93046ad8ab2

📥 Commits

Reviewing files that changed from the base of the PR and between 7336fa6 and b7bd37c.

⛔ Files ignored due to path filters (2)

• package-lock.json is excluded by !**/package-lock.json
• src-tauri/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• .github/workflows/build.yml
• package.json

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​postcss@​8.5.26 ⏵ 8.5.28	+1		+1
	cargo/​tauri-plugin-shell@​2.3.5 ⏵ 2.3.6	-1
	cargo/​tauri-plugin-log@​2.9.0 ⏵ 2.9.1
	npm/​autoprefixer@​10.5.4 ⏵ 10.5.5	+1		+1
	cargo/​tauri-plugin-dialog@​2.7.1 ⏵ 2.7.3
	cargo/​tauri-plugin-fs@​2.5.1 ⏵ 2.5.2
	npm/​@​tauri-apps/​plugin-shell@​2.3.5 ⏵ 2.3.6				+5
	cargo/​tokio-rustls@​0.26.5
	npm/​@​tauri-apps/​plugin-log@​2.9.0 ⏵ 2.9.1	+1			+2
	npm/​@​tauri-apps/​plugin-dialog@​2.7.2 ⏵ 2.7.3				+2

View full report