chore: update dependencies

[Azganoth]

Summary

Brings every dependency to its latest release except WebdriverIO 10, with the compatibility changes the updates require.

• Tauri 2.12 moves on both sides at once: the @tauri-apps/* packages with their crates, and the WebdriverIO Tauri plugin with its crates at 1.5.0. The Tauri CLI refuses to build when an npm package and its crate differ in major or minor version, which is why Dependabot's separate npm and cargo groups each failed the desktop build. 2.12 also binds queued channel IPC data to the webview it was created for (GHSA-w28w-mhc8-qvjv), drops event listeners when their window or webview is destroyed, and loads asset:// files off the event loop. Cargo.toml floors follow the resolved versions, including the notify 9.0.0-rc.5 the lockfile already resolved.
• oxlint 1.84 extends unicorn/consistent-function-scoping to functions that read only an outer ancestor's bindings. The ten it reports move to the scope that owns what they read; the context popup's root mouse and drag handlers move to the plugin rather than to module scope, since they share its pointer state.
• Milkdown 7.22.3 moves with mdast-util-to-markdown 2.2.0 and micromark-util-types 2.0.3, keeping the single copies those exact pins exist for. The serializer's 2.1.3 escaping and line-ending fixes change no bytes the round-trip suites assert.
• From Base UI 1.8, pressing a focusable control outside a non-modal popover closes it as focus-out rather than outside-press, because focus moves before the click lands. The context popup and block insertion menu now treat a focus-out that hands focus to another element as a dismissal from outside, so they no longer pull focus back into the editor from the control that was clicked. Focus lost to nothing still returns to the editor.
• Majors: parse5 8 (ESM-only), Vitest 5, happy-dom 21, and KaTeX 0.19, whose strict change does not reach the strict: "ignore" math rendering uses.
• Minor and patch: React 19.3, Base UI 1.9, Vite 8.3, Mermaid 12.1, Shiki 4.5, lucide-react, WebdriverIO 9.32, and the rest of the npm and Cargo trees.

Related Issue

Not applicable

Verification

• pnpm check passed.
• corpusRoundTrip and markdownCompatibility tests pass with the new serializer and Milkdown, so the corpus round trips and written-byte assertions hold.
• editor-context-popup tests: a click on a focusable control outside the popup leaves focus on that control. The test passes on Base UI 1.7.0 and fails on 1.8.0 without the change. popoverDismissal tests separate focus another element took from focus lost to nothing.
• Every @tauri-apps/* package and @wdio/tauri-plugin resolve to exactly their crate's version.

Not verified:

• the desktop E2E suite, which CI runs;
• by eye: KaTeX's fallback to the browser math font before Times New Roman (0.18.10), Mermaid 12.1 keeping the theme's generated values when a theme variable is partially overridden, and Base UI 1.8–1.9's menu and menubar focus fixes;
• an installed build.

Notes

• WebdriverIO stays on 9: @wdio/tauri-service 1.5.0, the latest, peers webdriverio ^9. Node 26 and @types/node 26 stay out, per dependabot.yml.
• @wdio/tauri-plugin 1.5.0 pins @tauri-apps/api 2.12.1, so the desktop E2E bundle carries that copy beside the app's 2.12.3. The production build does not import the plugin.
• The shadcn CLI now depends on cn, a package name unused since 2013 that shadcn has published from shadcn-ui/cn since September 2026. Its publisher and repository match the CLI's, and none of the packages new to the tree runs install scripts.
• Supersedes chore: bump the minor-and-patch group with 40 updates #603, chore: bump parse5 from 7.3.0 to 8.0.1 #604, and chore: bump the minor-and-patch group across 1 directory with 11 updates #691.