fix(build): align Tauri CLI with Rust runtime

[fu050409]

Summary by Sourcery

Align the Tauri toolchain and workspace dependency management to ensure consistent builds and updater-compatible Linux packages.

Bug Fixes:

• Align the Tauri CLI and Rust runtime versions so Linux packages preserve the bundle metadata required by the updater.

Enhancements:

• Centralize pnpm workspace dependency overrides and build permissions.
• Standardize dependency installation on the shared root lockfile across CI, Docker builds, and package documentation.

Build:

• Update pnpm and Tauri-related JavaScript and Rust dependencies to compatible versions.

CI:

• Use root-level dependency installation throughout CI and avoid unsupported pnpm caching on Windows.

Documentation:

• Update UI and documentation setup instructions to use the shared frozen lockfile installation.

Chores:

• Add a patch release note for the Tauri bundle metadata fix.

[sourcery-ai]

Reviewer's Guide

This PR updates the Tauri CLI dev dependency to match the Rust runtime version and moves pnpm-specific configuration from package.json into pnpm-workspace.yaml, aligning build tooling and workspace settings with pnpm’s recommended structure.

Flow diagram for pnpm workspace overrides and allowBuilds resolution

flowchart TD
  A["pnpm install in workspace"] --> B["Read pnpm-workspace.yaml"]
  B --> C["Apply overrides for workspace packages"]
  C --> D["Check allowBuilds flags"]
  D -->|true| E["Build allowed dependencies (core-js, esbuild, msw)"]
  D -->|false| F["Skip builds for disallowed deps (@j178/prek, sharp, workerd)"]
  E --> G["Complete install with workspace-aligned tooling"]
  F --> G

Loading

File-Level Changes

Change	Details	Files
Update Tauri CLI dev dependency to the newer version aligned with the Rust runtime.	Bump @tauri-apps/cli devDependency version from ^2.9.6 to ^2.11.4 in the root package manifest Ensure the JS-side Tauri tooling matches the Rust runtime version used by the project	package.json
Refactor pnpm configuration out of package.json into pnpm-workspace.yaml and adjust build-related settings.	Remove the packageManager field from package.json to decouple the repo from a specific pnpm version Remove inline pnpm.overrides and pnpm.onlyBuiltDependencies configuration from package.json Add equivalent overrides section to pnpm-workspace.yaml to control dependency resolutions at the workspace level Add allowBuilds section in pnpm-workspace.yaml to control which dependencies are allowed to build native components, updating values for several key packages	package.json pnpm-workspace.yaml
Regenerate pnpm-lock.yaml to reflect the updated dependency graph and new pnpm configuration.	Update lockfile entries to capture the new @tauri-apps/cli version Update lockfile metadata to match workspace-level overrides and build allowances	pnpm-lock.yaml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[github-actions]

📦 Semifold release plan

Plan calculated through commit 527a64b.

Changesets introduced by this pull request: fix-tauri-bundle-type

1 changesets · 1 packages

Package	Current	Next	Bump	Reason
dropout	0.2.0-rc.1	0.2.0-rc.2	patch	changeset

This comment updates automatically as the pull request changes.

[sourcery-ai]

Hey - I've left some high level feedback:

• Now that overrides are applied at the workspace level, consider verifying whether any package previously relied on different local overrides and, if so, document or adjust those to avoid unexpected resolution changes.
• The new allowBuilds configuration introduces explicit build controls; you may want to audit other build-time dependencies across packages to ensure they are correctly classified so that pnpm doesn’t skip necessary builds or perform unnecessary ones.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Now that overrides are applied at the workspace level, consider verifying whether any package previously relied on different local overrides and, if so, document or adjust those to avoid unexpected resolution changes.
- The new allowBuilds configuration introduces explicit build controls; you may want to audit other build-time dependencies across packages to ensure they are correctly classified so that pnpm doesn’t skip necessary builds or perform unnecessary ones.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[Copilot]

Pull request overview

Aligns the repo’s JavaScript workspace configuration for newer pnpm/Tauri tooling by moving pnpm settings into pnpm-workspace.yaml and bumping the Tauri CLI dependency.

Changes:

• Move pnpm dependency overrides from package.json to pnpm-workspace.yaml (workspace-level).
• Replace the prior onlyBuiltDependencies config with an allowBuilds allow/deny list in pnpm-workspace.yaml.
• Update @tauri-apps/cli to ^2.11.4 and refresh pnpm-lock.yaml accordingly.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
pnpm-workspace.yaml	Adds workspace-level pnpm overrides and build-allowlisting configuration.
pnpm-lock.yaml	Updates lockfile to reflect the new overrides/config and the Tauri CLI version bump.
package.json	Removes packageManager, removes embedded pnpm config, and bumps @tauri-apps/cli.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.