* fix(deps): resolve low and medium Dependabot alerts
Bump vulnerable transitive and direct dependencies across npm, Go, and
Rust to clear all fixable low/medium severity Dependabot advisories.
npm (pnpm.overrides, scoped by major; hono pinned in @kandev/theme to
force the shadcn dev-CLI peer):
- ajv@6 6.15.0, @babel/core 7.29.x, body-parser 2.3.0,
brace-expansion 1.1.16/2.1.2, dompurify 3.4.12, hono 4.12.x,
@hono/node-server 2.0.x, js-yaml 4.3.0, lodash(-es) 4.18.x,
markdown-it 14.3.x, mermaid 11.16.x, path-to-regexp@8 8.4.x,
picomatch@2 2.3.2, postcss 8.5.x, protobufjs 7.6.5, qs 6.15.x,
uuid@11 11.1.1, ws 8.21.x
Go: golang.org/x/net 0.55.0, github.com/jackc/pgx/v5 5.9.2
Rust (apps/desktop): serde_with 3.21.0, tauri family 2.11.x
(rand 0.7.3 dropped by the tauri cascade)
Highs are handled by a separate effort; docker/grpc left untouched.
Remaining unresolved mediums: glib (blocked by tauri's gtk ^0.18
constraint) and docker cp advisories (fix requires the docker major
bump owned by the highs effort / no patched version yet).
* fix(desktop): align @tauri-apps/cli with the 2.11 Rust crate bump
The Rust `tauri` crate moved to 2.11.5, but `@tauri-apps/cli` (which runs
`tauri build` for desktop packaging) was still pinned to 2.8.4. Tauri
expects the CLI and crate on the same minor line, so bump the CLI to
2.11.4 to keep packaging tooling in sync with the Cargo crates.
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
github-actions[bot]