[Harry19081]

Problem

Release builds from develop fail before compiling. The v2.0.0 release run (34849085732) stopped in the macOS Build ORGII step after one second:

Found version mismatched Tauri packages. Make sure the NPM package and Rust crate versions are on the same major/minor releases:
tauri (v2.11.1) : @tauri-apps/api (v2.10.1)

Root cause: the cargo-security update in #1719 (merged 2026-09-13) moved the Rust tauri crate pin from =2.10.3 to =2.11.1, but package.json still declares @tauri-apps/api as ~2.10.0 (locked at 2.10.1). tauri build requires the crate and the JS API to share a major/minor release, so every release build since #1719 aborts. PR CI never runs tauri build, so the mismatch first surfaced in the release job. The Windows and Linux jobs depend on the macOS job and were skipped. Nothing was published, and v1.3.0 is still the latest release.

Solution

Move @tauri-apps/api to ~2.11.0. The lockfile resolves it to 2.11.1, the current npm latest, for the app and the 11 plugin packages that depend on it. The Rust crate and the JS API are on the same minor release (2.11) again, and so is every tauri-plugin-* / @tauri-apps/plugin-* pair.

Aligning the npm side up keeps the security remediation from #1719. The alternative, pinning the crate back to 2.10.3, would reopen it.

Potential risks

• JS API minor bump. The 2.11.0 and 2.11.1 release notes list only additions (a Bring All to Front menu item, macOS icon/template in one step, a WebView general-autofill option, mobile Suspended/Resumed events) plus documentation. No removals or signature changes are listed. Since chore(deps): apply Cargo security updates with API compatibility fixes #1719 the frontend has run 2.10 JS bindings against the 2.11.1 runtime, so this change narrows that gap.
• Lockfile. The diff only touches @tauri-apps/api entries (16 lines changed). No other package re-resolved. To roll back, revert this commit, but release builds then fail again unless the crate pin is also reverted, which would undo chore(deps): apply Cargo security updates with API compatibility fixes #1719's security update.
• CLI left at 2.10.1. @tauri-apps/cli (spec "2") stays locked at 2.10.1, the version that bundled, signed and notarized v1.3.0. The mismatch gate does not compare the CLI. Aligning it to 2.11 is a separate change that I kept out of this unblocker.
• Not verified yet. Typecheck and unit tests against the 2.11.1 type definitions run in this PR's CI. A full tauri build only runs when the release workflow reruns after merge.

Verification

• pnpm install --lockfile-only --ignore-scripts (pnpm 9.15.4, the version pinned in packageManager): exit 0. The lockfile diff is limited to @tauri-apps/api 2.10.1 → 2.11.1. The unmet-peer warnings it printed already existed.
• Replicated the tauri build mismatch gate with a script comparing src-tauri/Cargo.lock against pnpm-lock.yaml major/minor versions. Before: tauri 2.11.1 vs @tauri-apps/api 2.10.1 mismatched. After: 0 mismatches across tauri and all 9 plugin pairs (deep-link, dialog, fs, notification, opener, process, shell, store, updater).
• Read the failing release job log (quoted above) to confirm the failure is only this gate.
• Reviewed the @tauri-apps/api v2.11.0 and v2.11.1 release notes for breaking changes (none listed).
• Pre-commit hook ran lint-staged (prettier on package.json) and passed. The commit was made in a linked worktree, where prepare-commit-msg cannot write the "Pre-commit hook ran." trailer, so the trailer is absent.
• Not run locally: typecheck, unit tests, and a full tauri build. CI covers the first two on this PR; the release workflow rerun covers the build.