chore(deps): bump tauri-plugin-shell to 2.2.1 (CVE-2025-31477)

[devin-ai-integration]

Summary

• Bumps tauri-plugin-shell =2.2.0 → =2.2.1 in desktop/src-tauri/Cargo.toml and Cargo.lock. Fixes CVE-2025-31477 / GHSA-c9pr-q8gx-3mgp (Critical): the shell plugin's open endpoint silently fell back to allow-all scope validation, letting file:, smb:, nfs: handlers through.
• Supersedes Dependabot PR chore(deps): bump tauri-plugin-shell from 2.2.0 to 2.2.1 in /desktop/src-tauri in the cargo group across 1 directory #570, which is unmergeable as-is: it branched before dev gained the [profile.release.build-override] section, so its Cargo.toml diff would delete that profile on merge. This PR is the same two-line bump applied to current dev.
• Actual exposure is low (capabilities grant opener:default only, no shell:allow-open), but the fix is a patch release with an identical dependency set.
• Dependabot alerts [WRONG BRANCH] fix(command-code): disable repository fsmonitor during git metadata collection #1 and [WRONG BRANCH] fix(ci): rerun PR gate on review findings #2 resolve when this merges. Merging this also makes chore(deps): bump tauri-plugin-shell from 2.2.0 to 2.2.1 in /desktop/src-tauri in the cargo group across 1 directory #570 obsolete — it can be closed.

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Verification

• Applied the exact Cargo.lock version/checksum change Dependabot computed for 2.2.1 (69d5eb33…); dependency list unchanged from 2.2.0.
• Diff reviewed: only Cargo.toml pin + Cargo.lock version/checksum lines change; build-override profile preserved.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Link to Devin session: https://app.devin.ai/sessions/18173a51bcf04824a2e66ca1d2e42ccf
Open in Devin Desktop: https://app.devin.ai/desktop/session/18173a51bcf04824a2e66ca1d2e42ccf?variant=devin
Requested by: @luvs01

---

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 131cb52a-18f9-4866-bb52-fc1d9946b428

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

✅ READY

• all PR quality gates passed; the review readiness checklist is complete.

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request is already Ready for Review.
The review-ready label marks this PR as ready; review automation runs independently.
Maintainers: @lidge-jun @Ingwannu

[luvs01]

Consolidated into lidge-jun#5525 as the existing upstream dependency update.

Source head: 184f8716f29fd87f593e7305ec9b05a974ea3f7a. Replacement head: d6dea8f246944677c8ce80264c66095b562e3deb.

The complete functional patch 43a43f58a9a0e4019ea5ad5af260b5191a4ffcdd has the same stable Git patch ID as upstream d6dea8f246944677c8ce80264c66095b562e3deb. Both Cargo.toml and Cargo.lock pin tauri-plugin-shell to 2.2.1 with checksum 69d5eb3368b959937ad2aeaf6ef9a8f5d11e01ffe03629d3530707bbcb27ff5d. Later source commits only synchronize dev or retrigger CI and have no additional contribution diff. The upstream tree also retains its newer macos-private-api feature; no functional fork change is omitted. Reusing the existing upstream PR avoids importing the same dependency update again. Build, platform CI and security review still belong to the upstream update; no merge or deployment is claimed.

Closing this duplicate standalone review entry as part of the requested consolidation after verifying coverage. This is not a merge or release claim; remaining integration checks and reviews are tracked on the replacement. Original branches are retained.