Skip to content

build(deps-dev): bump @tauri-apps/cli from 2.11.4 to 2.11.5 in /app - #179

Merged
github-actions[bot] merged 1 commit into
devfrom
dependabot/npm_and_yarn/app/dev/tauri-apps/cli-2.11.5
Sep 28, 2026
Merged

github-actions[bot] merged 1 commit into
devfrom
dependabot/npm_and_yarn/app/dev/tauri-apps/cli-2.11.5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 28, 2026 •

Copy link
Copy Markdown
Contributor

Bumps @tauri-apps/cli from 2.11.4 to 2.11.5.

Release notes

Sourced from @​tauri-apps/cli's releases.

@​tauri-apps/cli v2.11.5

[2.11.5]

Security fixes

  • 5a87bab12 Record the app version in the trusted comment of updater signatures, so a signed artifact is bound to the version it was released as.

    An update endpoint response is not signed, and the signature only covers the downloaded artifact, so the announced version on its own does not prove which release the url and signature point at. minisign covers the trusted comment with its global signature, which lets the updater plugin compare the two and reject a response that pairs a version number with a different release. Enable requireSignedVersion in the updater plugin configuration to enforce this.

    tauri build fills the version in automatically, and tauri plugin add updater now enables requireSignedVersion for the project it is adding the plugin to. tauri signer sign gains an --app-version flag for signing updater artifacts by hand, and warns when it is omitted.

Dependencies

  • Upgraded to tauri-cli@2.11.5
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 28, 2026
@socket-security

socket-security Bot commented Sep 28, 2026 •

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​tauri-apps/​cli@​2.11.4 ⏵ 2.11.591 +110088 +198 +1100

View full report

@github-actions
github-actions Bot enabled auto-merge September 28, 2026 13:38
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/app/dev/tauri-apps/cli-2.11.5 branch 3 times, most recently from bc29312 to baf4fbc Compare September 28, 2026 14:02
Bumps [@tauri-apps/cli](https://github.com/tauri-apps/tauri) from 2.11.4 to 2.11.5.
- [Release notes](https://github.com/tauri-apps/tauri/releases)
- [Commits](https://github.com/tauri-apps/tauri/compare/@tauri-apps/cli-v2.11.4...@tauri-apps/cli-v2.11.5)

---
updated-dependencies:
- dependency-name: "@tauri-apps/cli"
  dependency-version: 2.11.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/app/dev/tauri-apps/cli-2.11.5 branch from baf4fbc to 993221c Compare September 28, 2026 14:08
@github-actions
github-actions Bot merged commit 45099ae into dev Sep 28, 2026
8 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/app/dev/tauri-apps/cli-2.11.5 branch September 28, 2026 14:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants