chore(deps): bump the npm-runtime group across 1 directory with 4 updates

[dependabot]

Bumps the npm-runtime group with 4 updates in the /src directory: @tauri-apps/plugin-dialog, @tauri-apps/plugin-fs, dompurify and marked.

Updates @tauri-apps/plugin-dialog from 2.7.1 to 2.7.3

Release notes

Sourced from @​tauri-apps/plugin-dialog's releases.

dialog-js v2.7.3

[2.7.3]

• db9c5998 (#3531 by @​Legend-Master) Fix missing consumer-rules.pro on Gradle v9.
• cc9ec9b4 (#3519 by @​purvsinojiya-inventyv) Fix Android save dialog MIME type when a single MIME type is provided.
• f8053e65 (#3527 by @​Legend-Master) Documented Cargo feature flags in each plugin's crate-level documentation.

Dependencies

• Upgraded to fs@2.5.2

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-dialog@2.7.3
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.5kB README.md
npm notice 6.9kB dist-js/index.cjs
npm notice 14.6kB dist-js/index.d.ts
npm notice 6.8kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 657B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-dialog
npm notice version: 2.7.3
npm notice filename: tauri-apps-plugin-dialog-2.7.3.tgz
npm notice package size: 6.7 kB
npm notice unpacked size: 33.3 kB
npm notice shasum: 7e6d375fec8e39d2a90294604a9d77e66c39a072
npm notice integrity: sha512-CRgE+7TP4tvq9[...]oKbMwSI4IEcfA==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2662645358
+ @tauri-apps/plugin-dialog@2.7.3

dialog v2.7.3

[2.7.3]

... (truncated)

Commits

• 6aa2854 publish new versions (#3509)
• 9d6d032 chore(deps): update h2 to 0.4.19 (#3556)
• 98f8787 ci: fix typo in workflow permissions
• 1a7b12c ci: add explicit token permissions
• 2f4c85c chore(deps): bump serde_with (#3490)
• c546de0 chore(deps): update dependency rollup to v4.62.5 (#3520)
• db9c599 fix(android): missing consumer-rules.pro (#3531)
• 9c93437 chore(deps): update dependency typescript-eslint to v8.66.0 (#3391)
• 685610a fix(fs): default permissions (#3507)
• f8053e6 docs: cargo features (#3527)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-fs from 2.5.1 to 2.5.2

Release notes

Sourced from @​tauri-apps/plugin-fs's releases.

fs-js v2.5.2

[2.5.2]

• db9c5998 (#3531 by @​Legend-Master) Fix missing consumer-rules.pro on Gradle v9.
• f8053e65 (#3527 by @​Legend-Master) Documented Cargo feature flags in each plugin's crate-level documentation.
• 685610ae (#3507 by @​Legend-Master) Fix fs:default and fs:read-app-specific-dirs-recursive not giving any command scopes
• 3fb27bf1 (#3504 by @​vasfvitor) Fixed deny-webview-data has no effect, and on Linux, only deny access to the webview data paths instead of the entire $APPLOCALDATA

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-fs@2.5.2
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 2.4kB README.md
npm notice 32.8kB dist-js/index.cjs
npm notice 32.6kB dist-js/index.d.ts
npm notice 32.0kB dist-js/index.js
npm notice 697B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-fs
npm notice version: 2.5.2
npm notice filename: tauri-apps-plugin-fs-2.5.2.tgz
npm notice package size: 21.5 kB
npm notice unpacked size: 101.5 kB
npm notice shasum: 262ff39542e50e96f1ee8b6b7d471898736d6609
npm notice integrity: sha512-XXvMSnFiob+G1[...]J5sDsniRyWxlg==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2662643742
+ @tauri-apps/plugin-fs@2.5.2

fs v2.5.2

[2.5.2]

• db9c5998 (#3531 by @​Legend-Master) Fix missing consumer-rules.pro on Gradle v9.
• f8053e65 (#3527 by @​Legend-Master) Documented Cargo feature flags in each plugin's crate-level documentation.
• 685610ae (#3507 by @​Legend-Master) Fix fs:default and fs:read-app-specific-dirs-recursive not giving any command scopes

... (truncated)

Commits

• 6aa2854 publish new versions (#3509)
• 9d6d032 chore(deps): update h2 to 0.4.19 (#3556)
• 98f8787 ci: fix typo in workflow permissions
• 1a7b12c ci: add explicit token permissions
• 2f4c85c chore(deps): bump serde_with (#3490)
• c546de0 chore(deps): update dependency rollup to v4.62.5 (#3520)
• db9c599 fix(android): missing consumer-rules.pro (#3531)
• 9c93437 chore(deps): update dependency typescript-eslint to v8.66.0 (#3391)
• 685610a fix(fs): default permissions (#3507)
• f8053e6 docs: cargo features (#3527)
• Additional commits viewable in compare view

Updates dompurify from 3.4.11 to 3.4.15

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.15

• Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
• Added several smaller hardening and edge-case improvements, thanks @​leechristensen
• Bumped several dependencies where possible

DOMPurify 3.4.14

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
• Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
• Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
• Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
• Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
• Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

• Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
• Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
• Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
• Bumped several dependencies where possible

DOMPurify 3.4.12

• Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
• Hardened the handling of hooks removing elements, @​mkrause-bee360
• Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
• Hardened the handling of declarative partial updates
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

Commits

• 1d7460c release: 3.4.15 (#1609)
• 4e6fe24 release: 3.4.14 (#1587)
• 3067f77 release: 3.4.13 (#1562)
• a9ca1e5 release: 3.4.12 (#1537)
• See full diff in compare view

Updates marked from 18.0.5 to 18.0.11

Release notes

Sourced from marked's releases.

v18.0.11

18.0.11 (2026-08-24)

Bug Fixes

• do not nest a link inside a link (#4051) (e250e31)
• inlineTokens rebuilds the reflink-mask preamble per call (#4040) (0653c24)
• keep emphasis in the text of a rejected reference link (#4059) (b699db3)

v18.0.10

18.0.10 (2026-08-18)

Bug Fixes

• keep the em/strong mask the same length as the source (#4044) (681373c)
• parse EOF backtick fences after paragraphs (#4039) (81bd750)
• place task checkboxes after list loose is finalized (#4046) (b8cf7dc), closes #4045

v18.0.9

18.0.9 (2026-08-04)

Bug Fixes

• an unmatched strong run before emphasis stays literal (#4008) (e8544e6)
• Fix spurious deeper nesting in a blockquote continuation (#4030) (452f1ed)
• pedantic foo: and "word" emphasis parsing (#3999) (823093f)

v18.0.8

18.0.8 (2026-08-04)

Bug Fixes

• fall back to default checkbox renderer when extension returns false (#4023) (e1b6139)

v18.0.7

18.0.7 (2026-07-21)

Bug Fixes

• Avoid O(n^2) backtracking in HTML block close and tilde interrupt regexes (#4014) (f945fc5), closes #3991
• Avoid O(n^2) masked source rebuild in inline tokenizer (#4017) (9154f8f)
• keep empty list after blockquote as a sibling block (#4004) (3f144a0)
• preserve code spans adjacent to tildes (#4012) (0de7188)
• Recognize setext headings whose first line starts with # (#4015) (f056437), closes #1
• treat a line of only tabs as a blank line between paragraphs (#4007) (bc2f121)

... (truncated)

Commits

• 53cb13f chore(release): 18.0.11 [skip ci]
• 0c6b2a6 docs: add adaptable bullet point (#4058)
• c430a64 chore(deps-dev): bump eslint from 10.8.1 to 10.9.0 (#4069)
• b699db3 fix: keep emphasis in the text of a rejected reference link (#4059)
• 0653c24 fix: inlineTokens rebuilds the reflink-mask preamble per call (#4040)
• e250e31 fix: do not nest a link inside a link (#4051)
• 8698d35 chore(release): 18.0.10 [skip ci]
• 58367a5 chore(deps-dev): bump eslint from 10.8.0 to 10.8.1 (#4055)
• a426c4d chore(deps-dev): bump esbuild from 0.28.1 to 0.28.2 (#4056)
• a5cf277 chore(deps-dev): bump highlight.js from 11.11.1 to 11.12.0 (#4057)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@tauri-apps/plugin-dialog	2.7.3	Unknown	Unknown
npm/@tauri-apps/plugin-fs	2.5.2	Unknown	Unknown
npm/dompurify	3.4.15	🟢 9.8	Details Check Score Reason Dependency-Update-Tool 🟢 10 update tool detected Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 10 all dependencies are pinned Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices 🟢 7 badge detected: Silver SAST 🟢 10 SAST tool is run on all commits License 🟢 10 license file detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected Fuzzing 🟢 10 project is fuzzed Signed-Releases 🟢 10 5 out of the last 5 releases have a total of 10 signed artifacts. Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 42 contributing companies or organizations
npm/marked	18.0.11	🟢 7.5	Details Check Score Reason Code-Review 🟢 8 Found 17/21 approved changesets -- score normalized to 8 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Packaging 🟢 10 packaging workflow detected

Scanned Files

• src/package-lock.json