fix(release): align Tauri package versions

CHANGELOG.md

@@ -63,10 +63,11 @@
 - **未安装时反复跳回检测页** — 安装失败不再强制重置向导；窗口聚焦只在后台更新检测结果，API Key / 配置错误改为页面内持续展示
 - **默认密码无提示挡住登录** — 使用出厂密码 `123456` 时，桌面与 Web 锁定页均直接提示并预填，登录后引导立即修改
 - **移动端语言菜单点穿** — 关闭状态不再拦截点击，切换语言后同步收起菜单和侧栏并更新 `html lang`
+- **跨平台发布被 Tauri 版本校验拦截** — 前端 `@tauri-apps/api` 与 Rust Tauri 同步到 `2.11` 系列，并增加锁文件主次版本一致性回归测试
 
 ### 测试与验证 (Testing)
 
-- Node.js `24.15.0` 下 `node --test tests/*.test.js`：511 passed
+- Node.js `24.15.0` 下 `node --test tests/*.test.js`：512 passed
 - Node.js `24.15.0` 下 `npm run build`：通过
 - `cargo fmt --all -- --check`：通过
 - `cargo check --locked`：通过

package-lock.json

@@ -9,7 +9,7 @@
       "version": "0.19.0",
       "license": "AGPL-3.0",
       "dependencies": {
-        "@tauri-apps/api": "^2.5.0",
+        "@tauri-apps/api": "^2.11.1",
         "@tauri-apps/plugin-autostart": "^2.5.1",
         "@tauri-apps/plugin-shell": "^2.2.1",
         "yaml": "^2.9.0"
@@ -812,9 +812,9 @@
       ]
     },
     "node_modules/@tauri-apps/api": {
-      "version": "2.10.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/api/-/api-2.10.1.tgz",
-      "integrity": "sha512-hKL/jWf293UDSUN09rR69hrToyIXBb8CjGaWC7gfinvnQrBVvnLr08FeFi38gxtugAVyVcTa5/FD/Xnkb1siBw==",
+      "version": "2.11.1",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/api/-/api-2.11.1.tgz",
+      "integrity": "sha512-M2FPuYND2m+wh5hfW9ZpSdxMPdEJovPBWwoHJmwUpysTYNHaOkVFN419m/K0LIgjb/7KU2vBgsUepJWugQCvAA==",
       "license": "Apache-2.0 OR MIT",
       "funding": {
         "type": "opencollective",

package.json

@@ -32,7 +32,7 @@
     "version:set": "node scripts/sync-version.js"
   },
   "dependencies": {
-    "@tauri-apps/api": "^2.5.0",
+    "@tauri-apps/api": "^2.11.1",
     "@tauri-apps/plugin-autostart": "^2.5.1",
     "@tauri-apps/plugin-shell": "^2.2.1",
     "yaml": "^2.9.0"

tests/release-readiness-regressions.test.js

@@ -65,6 +65,19 @@ test('Rust 锁文件包含 Tauri 与 tar 的安全修复版本', () => {
   assert.doesNotMatch(lock, /name = "tar"\r?\nversion = "0\.4\.45"/)
 })
 
+test('Rust Tauri 与前端 API 锁定在相同主次版本', () => {
+  const cargoLock = read('src-tauri/Cargo.lock')
+  const packageLock = JSON.parse(read('package-lock.json'))
+  const packageJson = JSON.parse(read('package.json'))
+  const rustVersion = cargoLock.match(/name = "tauri"\r?\nversion = "([^"]+)"/)?.[1]
+  const apiVersion = packageLock.packages?.['node_modules/@tauri-apps/api']?.version
+
+  assert.ok(rustVersion, 'Cargo.lock 缺少 tauri 版本')
+  assert.ok(apiVersion, 'package-lock.json 缺少 @tauri-apps/api 版本')
+  assert.equal(rustVersion.split('.').slice(0, 2).join('.'), apiVersion.split('.').slice(0, 2).join('.'))
+  assert.match(packageJson.dependencies?.['@tauri-apps/api'] || '', /^\^2\.11\./)
+})
+
 test('Hermes Rust 与 Web 关键 Provider 注册表保持一致', () => {
   const rust = read('src-tauri/src/commands/hermes_providers.rs')
   const web = read('scripts/dev-api.js')