Consolidates eight of the ten open dependabot PRs into a single
review surface. Two are intentionally left out because they bundle
breaking-change deps that need source migration outside the scope
of a combine PR; dependabot recreates them on the next weekly tick:
- #5364 (cargo-tauri group, 13 updates) bumps hmac 0.12 -> 0.13
which removes Hmac::new_from_slice from the inherent impl, so
studio/src-tauri/src/native_backend_lease.rs:152 fails to
compile (error E0599). Also bumps sha2 0.10 -> 0.11 and
reqwest 0.12 -> 0.13 which have their own migration surfaces.
Needs a focused PR after the source migration.
- #5365 (bun-frontend group, 14 updates) bumps TypeScript
5.9 -> 6.0 promoting the baseUrl deprecation to a hard tsc
error, plus @assistant-ui/react 0.12 -> 0.14 renaming the
unstable_* exports, react-day-picker 9 -> 10 dropping the
table classname, and recharts 3.7 -> 3.8.1 tightening the
Key prop type. Same shape: needs a focused frontend
migration PR.
The remaining eight land cleanly:
- #4916 oxc-parser 0.123.0 -> 0.129.0 in /studio/backend/core/
data_recipe/oxc-validator (npm-oxc-validator group)
- #5343 hono 4.12.17 -> 4.12.18 and ip-address 10.1.0 -> 10.2.0
in /studio/frontend (security advisory: GHSA-p77w-8qqv-26rm,
GHSA-qp7p-654g-cw7p, GHSA-hm8q-7f3q-5f36)
- #5362 python group (3 updates) in pyproject.toml
- #5363 actions group (3 updates) in release-desktop /
security-audit / studio-tauri-smoke workflows
- #5366 openssl 0.10.76 -> 0.10.79 (security)
- #5367 rand 0.10.0 -> 0.10.1 (security)
- #5368 tauri 2.10.3 -> 2.11.1 (security; transitive bumps for
tray-icon and wry come along)
- #5369 rustls-webpki 0.103.10 -> 0.103.13 (security)
studio/src-tauri/Cargo.toml stays at main's values (hmac 0.12,
sha2 0.10, reqwest 0.12, rand 0.10.0, windows-sys 0.59); Cargo.lock
is regenerated by running cargo update -p <pkg> --precise <ver> for
each of the four security advisories on top of main, so only the
four pinned packages move and the rest of the dep graph stays
identical to main. Validated locally: cargo check passes through
the Rust source; the only error is the build-time frontendDist
check unrelated to source.
fadf48f562