chore(deps): refresh compatible npm and cargo dependencies

[mpiton]

Summary

Compatible dependency refresh for the desktop app (npm + Cargo). Security: react-router 7.18.3 (CSRF advisory). npm audit is clean after transitive fixes.

Why

Patch/minor updates only. Majors (Vite 8, TypeScript 7, React Router 8, SeaORM 2, bincode 3, keyring 4, RustCrypto 0.9) stay deferred.

Pins kept on purpose

• oxlint 1.59: 1.81 turns React Compiler rules into correctness errors
• @tanstack/react-query ~5.101.2: 5.102.8 broke CaptchaView pending-image fetch
• extism =1.30.0 / command-group =5.0.1
• sea-orm 1.1.20

Testing

• npx oxlint . (0 errors)
• npx tsc -b
• npx vitest run: 747 passed
• cargo test --workspace: 1820 passed, 5 ignored
• cargo clippy --workspace --all-targets -- -D warnings
• cargo deny check advisories bans licenses sources
• npm audit: 0 vulnerabilities

Summary by CodeRabbit

• Chores
  • Updated application, development, and Rust dependency versions.
  • Refreshed security advisory exceptions to reflect current transitive dependencies.
  • Pinned the Unix libc dependency to version 0.2.189.

---

Summary by cubic

Refreshes compatible npm and Cargo dependencies, including the react-router 7.18.3 CSRF fix. Major upgrades (Vite 8, TypeScript 7, React Router 8, SeaORM 2, bincode 3, keyring 4, RustCrypto 0.9) stay deferred.

Dependencies

• Pins extism at 1.30.0, command-group at 5.0.1, and sea-orm at 1.1.20.
• Keeps oxlint at 1.59.0 because 1.81 turns React Compiler rules into correctness errors.
• Caps @tanstack/react-query at ~5.101.2 because 5.102.8 broke the CaptchaView pending-image fetch.
• Updates deny.toml ignores for wasmtime 43 advisories that still have no Extism-compatible upgrade.

Testing

• vitest passes 747 tests; cargo test passes 1820.
• tsc, oxlint, clippy, cargo deny, and npm audit (0 vulnerabilities) all pass cleanly.

^{Written for commit fda9e67. Summary will update on new commits.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 2cf2b393-03fb-45d5-80d5-9a9947fa8c9d

📥 Commits

Reviewing files that changed from the base of the PR and between 91ca8af and fda9e67.

⛔ Files ignored due to path filters (2)

• package-lock.json is excluded by !**/package-lock.json
• src-tauri/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• deny.toml
• package.json
• src-tauri/Cargo.toml

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

---

📝 Walkthrough

Walkthrough

The pull request updates JavaScript and Rust dependency versions. It pins Unix libc to 0.2.189 and revises RustSec advisory ignores for Extism-pinned wasmtime dependencies.

Changes

Dependency and advisory maintenance

Layer / File(s)	Summary
JavaScript dependency updates package.json	Production and development dependency version ranges were updated across the application and tooling packages.
Rust dependency updates src-tauri/Cargo.toml	Runtime, Unix-specific, and development dependency versions were updated. Existing feature settings remain unchanged.
RustSec advisory policy deny.toml	The previous proc-macro-error2 and quick-xml exceptions were replaced with documented ignores for Extism-pinned wasmtime 43.x and related transitive crates.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to fda9e

This updates compatible frontend and Rust dependencies and advisory policy exceptions. The supplied validation results show no current compatibility or security defect, so no merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: refreshing compatible npm and Cargo dependencies. It matches the stated pull request objectives and the files changed.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

---

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​tokio@​1.52.3 ⏵ 1.53.1
	npm/​@​tanstack/​react-virtual@​3.14.6 ⏵ 3.14.10	+1			-1
	npm/​@​radix-ui/​react-slot@​1.3.0 ⏵ 1.3.3	+1		+1	-2
	npm/​@​types/​react-dom@​19.2.3 ⏵ 19.2.5	+1		+1
	npm/​@​types/​react@​19.2.17 ⏵ 19.2.18	+1		+1
	npm/​@​vitest/​coverage-v8@​4.1.10 ⏵ 4.1.11
	npm/​vitest@​4.1.10 ⏵ 4.1.11			+1
	npm/​react-router@​7.18.1 ⏵ 7.18.3	+1	+16	+1	+1
	cargo/​thiserror@​2.0.18 ⏵ 2.0.20
	cargo/​anyhow@​1.0.103 ⏵ 1.0.104
	npm/​lucide-react@​1.24.0 ⏵ 1.40.0			+1
	cargo/​serde@​1.0.228 ⏵ 1.0.229
	npm/​radix-ui@​1.6.2 ⏵ 1.6.7	+1		+2	-2
	cargo/​serde_json@​1.0.150 ⏵ 1.0.151
	npm/​sonner@​2.0.7 ⏵ 2.0.8			+1
	npm/​tailwindcss@​4.3.2 ⏵ 4.3.3	+1		+1	+2
	npm/​react@​19.2.7 ⏵ 19.2.8
	cargo/​libc@​0.2.186 ⏵ 0.2.189	+8		+8
	npm/​@​tanstack/​react-query@​5.101.2 ⏵ 5.101.4				+1
	cargo/​tauri-plugin-updater@​2.10.1 ⏵ 2.11.0
	cargo/​tauri-plugin-clipboard-manager@​2.3.2 ⏵ 2.3.3
	cargo/​tauri-plugin-notification@​2.3.3 ⏵ 2.4.0
	cargo/​tauri-plugin-dialog@​2.7.1 ⏵ 2.7.3
	npm/​@​tailwindcss/​vite@​4.3.2 ⏵ 4.3.3	+1		+1	+2
	npm/​typescript@​5.7.3 ⏵ 5.9.3	+1		+1
	npm/​zustand@​5.0.14 ⏵ 5.0.15	+1		+1
	npm/​oxlint@​1.74.0 ⏵ 1.59.0
	npm/​lefthook@​2.1.10 ⏵ 2.1.12
	npm/​react-dom@​19.2.7 ⏵ 19.2.8
	npm/​i18next@​26.3.6 ⏵ 26.4.1			+1	-2
	npm/​@​testing-library/​react@​16.3.2 ⏵ 16.3.3	+1
	cargo/​flate2@​1.1.9 ⏵ 1.1.10
	cargo/​futures-util@​0.3.32 ⏵ 0.3.34
See 9 more rows in the dashboard

View full report

[cubic-dev-ai]

No issues found across 5 files

_{Re-trigger cubic}

[codspeed-hq]

Merging this PR will degrade performance by 2.92%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 2 improved benchmarks
❌ 2 regressed benchmarks
✅ 22 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	normalize_link_check_parallelism	120.8 ns	150 ns	-19.44%
❌	normalize_max_concurrent	120.8 ns	150 ns	-19.44%
⚡	create_valid	310.6 ns	252.2 ns	+23.13%
⚡	reject_invalid	581.1 ns	522.8 ns	+11.16%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing chore/dependency-upgrades (fda9e67) with main (91ca8af)}