chore(deps): bump the npm group across 1 directory with 5 updates

[dependabot]

Bumps the npm group with 5 updates in the / directory:

Package	From	To
@tauri-apps/api	2.10.1	2.11.1
@tauri-apps/plugin-dialog	2.6.0	2.7.2
@tauri-apps/plugin-opener	2.5.3	2.5.4
@tauri-apps/cli	2.9.6	2.11.4
tsx	4.22.4	4.23.5

Updates @tauri-apps/api from 2.10.1 to 2.11.1

Release notes

Sourced from @​tauri-apps/api's releases.

@​tauri-apps/api v2.11.1

No known vulnerabilities found

[2.11.1]

Enhancements

• 916782601 (#15520 by @​polw1) Document that Monitor.size, Monitor.position and Monitor.workArea are in physical pixels, with examples showing how to convert them to the logical pixels expected by window creation options via toLogical(monitor.scaleFactor).

> @tauri-apps/api@2.11.1 npm-publish /home/runner/work/tauri/tauri/packages/api
> pnpm build && cd ./dist && pnpm publish --access public --loglevel silly --no-git-checks
> @​tauri-apps/api@​2.11.1 build /home/runner/work/tauri/tauri/packages/api
> rollup -c --configPlugin typescript
�[36m
�[1m./src/app.ts, ./src/core.ts, ./src/dpi.ts, ./src/event.ts, ./src/image.ts, ./src/index.ts, ./src/menu.ts, ./src/mocks.ts, ./src/path.ts, ./src/tray.ts, ./src/webview.ts, ./src/webviewWindow.ts, ./src/window.ts�[22m → �[1m./dist, ./dist�[22m...�[39m
�[32mcreated �[1m./dist, ./dist�[22m in �[1m883ms�[22m�[39m
�[36m
�[1msrc/index.ts�[22m → �[1m../../crates/tauri/scripts/bundle.global.js�[22m...�[39m
�[32mcreated �[1m../../crates/tauri/scripts/bundle.global.js�[22m in �[1m1.4s�[22m�[39m
npm verbose cli /opt/hostedtoolcache/node/24.16.0/x64/bin/node /opt/hostedtoolcache/node/24.16.0/x64/bin/npm
npm info using npm@11.13.0
npm info using node@v24.16.0
npm silly config load:file:/opt/hostedtoolcache/node/24.16.0/x64/lib/node_modules/npm/npmrc
npm silly config load:file:/tmp/286e8dee195254a4370e608b672019b0/.npmrc
npm silly config load:file:/home/runner/.npmrc
npm silly config load:file:/home/runner/.config/pnpm/rc
npm verbose title npm publish tauri-apps-api-2.11.1.tgz
npm verbose argv "publish" "--ignore-scripts" "tauri-apps-api-2.11.1.tgz" "--access" "public" "--loglevel" "silly"
npm verbose logfile logs-max:10 dir:/home/runner/.npm/_logs/2026-06-17T13_41_23_851Z-
npm verbose logfile /home/runner/.npm/_logs/2026-06-17T13_41_23_851Z-debug-0.log
npm warn Unknown env config "verify-deps-before-run". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm warn Unknown env config "npm-globalconfig". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm warn Unknown env config "overrides". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm warn Unknown env config "_jsr-registry". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm silly logfile done cleaning log files
npm verbose publish [ 'tauri-apps-api-2.11.1.tgz' ]
</tr></table>

... (truncated)

Commits

• 6f6ab12 apply version updates (#15409)
• 728c8d4 fix(cli): skip building bundles when using tauri android run (#15473)
• e25f45c refactor: remove impl clone on inner menus (#15553)
• fbcf1b0 chore(deps): update dependency eslint-plugin-security to v4.0.1 (#15545)
• 828f710 fix(cli): respect src/bin required-features (fix: #15325) (#15427)
• ed8fd41 chore(cli): lesser verbose ureq_proto log (#15552)
• 50b0237 fix(android): escape special characters in strings.xml (#15549)
• 800223d docs: fix some missing and wrong docs (#15548)
• 5075c81 fix: check is_maximizable in internal_toggle_maximize (#15550)
• 532c22a chore(deps-dev): bump vite from 8.0.5 to 8.0.16 (#15547)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-dialog from 2.6.0 to 2.7.2

Release notes

Sourced from @​tauri-apps/plugin-dialog's releases.

dialog-js v2.7.2

[2.7.2]

• 40ae0a7f (#3491 by @​Legend-Master) Use com.google.android.material.dialog.MaterialAlertDialogBuilder instead of AlertDialog so the dialog follows the app's theme

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-dialog@2.7.2
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.5kB README.md
npm notice 6.9kB dist-js/index.cjs
npm notice 14.6kB dist-js/index.d.ts
npm notice 6.8kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 657B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-dialog
npm notice version: 2.7.2
npm notice filename: tauri-apps-plugin-dialog-2.7.2.tgz
npm notice package size: 6.7 kB
npm notice unpacked size: 33.3 kB
npm notice shasum: 322d0874bae71fed6d10c76168fa0f7f4d5dd875
npm notice integrity: sha512-pX0IGm1I3I6wc[...]0jQGQNyOvLrsg==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2194858458
+ @tauri-apps/plugin-dialog@2.7.2

dialog v2.7.2

[2.7.2]

• 40ae0a7f (#3491 by @​Legend-Master) Use com.google.android.material.dialog.MaterialAlertDialogBuilder instead of AlertDialog so the dialog follows the app's theme

... (truncated)

Commits

• 03afae6 publish new versions (#3500)
• 57ac986 chore(deps): update dependency @​tauri-apps/cli to v2.11.4 (#3463)
• 2ed6d6c fix(store): StoreOptions.defaults should not be required (#3499)
• cdfd462 chore(example): set color-cheme (#3493)
• d6e0b6b chore(example): clean up and migrate to ts partially (#3492)
• 40ae0a7 enhance(dialog): use MaterialAlertDialogBuilder (#3491)
• edc52ea chore(deps): bump create-pull-request to v8 (#3489)
• a0d949d chore(deps): update pnpm to v11 (#3487)
• 13c63af chore: fix clippy (#3488)
• cad301f publish new versions (#3447)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-opener from 2.5.3 to 2.5.4

Release notes

Sourced from @​tauri-apps/plugin-opener's releases.

opener-js v2.5.4

[2.5.4]

• c1fd33b3 (#3343 by @​Legend-Master) Fix revealItemInDir/reveal_items_in_dir can't reveal network paths like \\wsl.localhost\Ubuntu\etc on Windows

npm warn Unknown user config "always-auth". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-opener@2.5.4
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 3.1kB dist-js/index.cjs
npm notice 2.0kB dist-js/index.d.ts
npm notice 3.1kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 730B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-opener
npm notice version: 2.5.4
npm notice filename: tauri-apps-plugin-opener-2.5.4.tgz
npm notice package size: 3.5 kB
npm notice unpacked size: 14.1 kB
npm notice shasum: b37883e4d36125b8c5a0c74f683395958a65bd7d
npm notice integrity: sha512-1HnPkb+AmgO29[...]aUJtT57lfO9CQ==
npm notice total files: 7
npm notice
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=1429011743
+ @tauri-apps/plugin-opener@2.5.4

opener v2.5.4

[2.5.4]

• c1fd33b3 (#3343 by @​Legend-Master) Fix revealItemInDir/reveal_items_in_dir can't reveal network paths like \\wsl.localhost\Ubuntu\etc on Windows

... (truncated)

Commits

• e7a68fa publish new versions (#3068)
• b5550a3 chore: temp delete updater changefile
• 93426f8 fix: fix docsrs builds
• 4ee61e0 Revert "chore: temp delete updater changefile"
• See full diff in compare view

Updates @tauri-apps/cli from 2.9.6 to 2.11.4

Release notes

Sourced from @​tauri-apps/cli's releases.

@​tauri-apps/cli v2.11.4

[2.11.4]

Bug Fixes

• 67ffa192a (#15596 by @​FabianLars) Fixed an issue in the AppImage bundler that caused the /.desktop and .DirIcon files to be absolute symlinks instead of relative symlinks which caused problems with AppImage installers like AppManager.

Dependencies

• Upgraded to tauri-cli@2.11.4

@​tauri-apps/cli v2.11.3

[2.11.3]

Bug Fixes

• 50b0237ed (#15549 by @​Legend-Master) Escape special characters in productName when generating Android strings.xml

• 728c8d4a5 (#15473 by @​Legend-Master) Skip building bundles when using tauri android run

• be0cb0d43 (#15344 by @​raglady) Fix NDK_HOME environment variable not honored when set

• ed8fd411f (#15552 by @​Legend-Master) Make ureq_proto show trace level logs only on -vvv instead of -vv

• fca4a31f9 (#15454 by @​fallintoplace) Fix tauri migrate generating invalid namespace imports for aliased pluginified imports from @tauri-apps/api.

  Inputs like import { cli as superCli } from "@tauri-apps/api" now migrate to import * as superCli from "@tauri-apps/plugin-cli" instead of producing invalid ESM syntax. The migration tests also reparse migrated JS, Svelte, and Vue output so syntax regressions are caught directly.

Dependencies

• Upgraded to tauri-cli@2.11.3

@​tauri-apps/cli v2.11.2

[2.11.2]

Dependencies

• Upgraded to tauri-cli@2.11.2

@​tauri-apps/cli v2.11.1

[2.11.1]

Dependencies

• Upgraded to tauri-cli@2.11.1

@​tauri-apps/cli v2.11.0

[2.11.0]

New Features

• 926a57bb0 (#15201) Added uninstaller icon and uninstaller header image support for NSIS installer.

  Notes:

... (truncated)

Commits

• 8909f22 apply version updates (#15598)
• 67ffa19 fix(bundler): make .desktop and .DirIcon relative symlinks (#15596)
• c5c8b2b docs(readme): desktop platforms -> operating systems, closes #15589
• 80d437f fix(#15580): bump memmap2 (#15587)
• 469ecc8 test: regenerate stale macOS acl snapshot for has_app_acl (#15576)
• 5be0cb8 fix(ci): change strip to debuginfo for cloudflare worker (#15574)
• 4bbd497 chore(deps): bump cloudflare worker versions (#15573)
• 5712549 chore(deps): update dependency rollup to v4.62.0 (#15551)
• c8faedf ci: test on node 20,22 instead of node 18,20
• 3641e26 refactor: simplify menu code (#15559)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​tauri-apps/cli since your current version.

Updates tsx from 4.22.4 to 4.23.5

Release notes

Sourced from tsx's releases.

v4.23.5

4.23.5 (2026-08-02)

Bug Fixes

• detect the Node inspector enabled via NODE_OPTIONS (3c1d051)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.4

4.23.4 (2026-08-02)

Bug Fixes

• cli: allow async process.once() signal handlers to finish (#827) (2afc7bb)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.3

4.23.3 (2026-08-02)

Bug Fixes

• preserve listenerCount overload semantics (#823) (b6574d4)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.2

4.23.2 (2026-08-02)

Bug Fixes

• watch: exit with 128 + signal number when interrupted (#820) (0b00bc8)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.1

4.23.1 (2026-07-13)

... (truncated)

Commits

• c55004d test: remove legacy PTY retry
• e368161 chore(deps): update pty-spawn to 1.1.1
• 8d39496 ci: validate GitHub Actions workflows
• 6fe724e test: clean up timed-out PTY attempts
• e0a0536 ci: skip unused Windows Node cache
• 6d6dd84 ci: remove broken lock automation
• 3c1d051 fix: detect the Node inspector enabled via NODE_OPTIONS
• 40380a4 ci: lock down the release toolchain
• f217b6b ci: restrict releases to public repository
• 2afc7bb fix(cli): allow async process.once() signal handlers to finish (#827)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[PathGao]

Closing this without merging, and recording why so the next quarterly run is not re-litigated from scratch.

These two batches are two halves of one bump. #491 carries the npm side of the Tauri family, this carries the crate side, and tauri build refuses when a plugin's crate and npm halves disagree on major or minor — tauri-plugin-dialog (v2.7.2) : @tauri-apps/plugin-dialog (v2.6.0). Dependabot groups per ecosystem and cannot see across that line, so neither PR can merge on its own and both stay red. Taking them would mean a hand-made pull request carrying both halves.

That work is only worth doing if the bump is worth having, and I could not establish that it is. What is actually in here, checked against the upstream changelogs rather than assumed:

• tauri-plugin-dialog 2.6.0 → 2.7.2 — 2.7.2 changes the Android dialog to MaterialAlertDialogBuilder; 2.7.1 is a dependency bump; 2.7.0 makes ask/confirm reuse the message command internally and turns their permissions into aliases. Markpad is desktop-only. Nothing user-visible here.
• tauri-plugin-opener, tauri-plugin-single-instance, serde, serde_json, regex — patch bumps.
• tauri-build 2.5.5 → 2.6.3 and @tauri-apps/cli 2.9.6 → 2.11.4 — I expected these to clear the Failed to add bundler type to the binary: __TAURI_BUNDLE_TYPE variable not found warning in the release build, since that warning's own text suggests exactly this. They will not: the fix (tauri#13808, add #[used] to __TAURI_BUNDLE_TYPE so that it's not stripped in release builds) landed 2025-07-11, well before the 2.10.2 in our lockfile. The warning has some other cause, and it is harmless either way — the updater falls back to the unsuffixed {os}-{arch} key and our latest.json publishes only those.

So the batch clears no bug and adds no capability this app uses. Merging it would be motion, not progress.

What would change the answer. tauri itself is pinned at 2.10.2 while 2.11.5 has been out since 2026-07-01, and no Dependabot pull request has touched it — that is being looked into separately, because a bot that cannot see the core framework is a hole in the reporting, independent of whether the upgrade is wanted. If the core turns out to be takeable, the right shape is one hand-made pull request moving the whole Tauri family together, and these contents come along with it.

Since #490 moved npm and cargo to a quarterly schedule, this returns on its own in about three months. Nothing is lost by closing it now.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml