chore(deps): refresh packages and bundled engines

- update Lucide and compatible transitive Rust locks

- refresh Windows/Linux FFmpeg payloads with verified source hashes

- verify macOS release checks against the mounted DMG artifact

.github/workflows/release.yml

@@ -140,11 +140,21 @@ jobs:
       - name: Verify macOS packaged engines and launch
         if: runner.os == 'macOS'
         run: |
-          APP="src-tauri/target/${{ matrix.target }}/release/bundle/macos/Firelink.app"
+          set -euo pipefail
           DMG="$(find src-tauri/target/${{ matrix.target }}/release/bundle/dmg -name '*.dmg' -print -quit)"
           test -n "$DMG"
+          npm run verify:macos-signing -- --dmg "$DMG"
+          MOUNT_POINT="$(mktemp -d "$RUNNER_TEMP/firelink-dmg-mount.XXXXXX")"
+          cleanup() {
+            hdiutil detach "$MOUNT_POINT" -quiet || hdiutil detach "$MOUNT_POINT" -force -quiet || true
+            rmdir "$MOUNT_POINT" 2>/dev/null || true
+          }
+          trap cleanup EXIT
+          hdiutil attach -nobrowse -readonly -mountpoint "$MOUNT_POINT" "$DMG" >/dev/null
+          APP_COUNT="$(find "$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink.app' | wc -l | tr -d ' ')"
+          test "$APP_COUNT" -eq 1
+          APP="$(find "$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink.app' -print -quit)"
           FIRELINK_MACOS_APP="$APP" node scripts/app-associations.node-test.js
-          npm run verify:macos-signing -- --app "$APP" --dmg "$DMG"
           node scripts/verify-binaries.js --search-root "$APP" --target ${{ matrix.target }}
           ARIA2="$(find "$APP" -type f -name 'aria2c-${{ matrix.target }}' -print -quit)"
           test -n "$ARIA2"

RELEASE.md

@@ -50,10 +50,24 @@ cd ..
 npm run tauri build -- --target aarch64-apple-darwin --bundles dmg
 ```
 
-Verify packaged resources, then launch outside repository working directory:
+Verify the DMG and the app it contains, then launch outside the repository
+working directory. The DMG bundler removes the intermediate app directory, so
+the post-build checks must use the mounted release artifact:
 
 ```bash
-APP="src-tauri/target/aarch64-apple-darwin/release/bundle/macos/Firelink.app"
+DMG="$(find src-tauri/target/aarch64-apple-darwin/release/bundle/dmg -name '*.dmg' -print -quit)"
+test -n "$DMG"
+npm run verify:macos-signing -- --dmg "$DMG"
+MOUNT_POINT="$(mktemp -d -t firelink-dmg)"
+cleanup() {
+  hdiutil detach "$MOUNT_POINT" -quiet || hdiutil detach "$MOUNT_POINT" -force -quiet || true
+  rmdir "$MOUNT_POINT" 2>/dev/null || true
+}
+trap cleanup EXIT
+hdiutil attach -nobrowse -readonly -mountpoint "$MOUNT_POINT" "$DMG" >/dev/null
+APP_COUNT="$(find "$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink.app' | wc -l | tr -d ' ')"
+test "$APP_COUNT" -eq 1
+APP="$(find "$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink.app' -print -quit)"
 node scripts/verify-binaries.js --search-root "$APP" --target aarch64-apple-darwin
 node scripts/smoke-packaged-app.js --executable "$APP/Contents/MacOS/firelink"
 ```

engine-sources.lock.json

@@ -13,9 +13,9 @@
         "sha256": "171efab55ac6b9881fd53ee4c20f8bf3bb1340ffc618483746909014db12216a"
       },
       "ffmpeg": {
-        "version": "8.1.2-44-g7c533d0f86",
-        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-08-23-13-03/ffmpeg-n8.1.2-44-g7c533d0f86-win64-gpl-8.1.zip",
-        "sha256": "40d98aef3e8d48665c4dbbdd0093d6e50c61d71a3a48067e9d3edd9fb3a1f3ca"
+        "version": "8.1.2-46-g139afe709a",
+        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-08-26-13-06/ffmpeg-n8.1.2-46-g139afe709a-win64-gpl-8.1.zip",
+        "sha256": "f966bc2e843bcd680dedd6d1a2c0c895bab859a402c6dd107cbe72a796dfebcf"
       },
       "aria2c": {
         "version": "1.37.0",
@@ -35,9 +35,9 @@
         "sha256": "8b010a3b1a4a0188a67cdb8a7a27348b2a501af78aec7fc74f2ace167368d530"
       },
       "ffmpeg": {
-        "version": "8.1.2-44-g7c533d0f86",
-        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-08-23-13-03/ffmpeg-n8.1.2-44-g7c533d0f86-linux64-gpl-8.1.tar.xz",
-        "sha256": "fb1f9326d203d038f249d5399efb34f4597836f54ad0bcffcc7040af25576493"
+        "version": "8.1.2-46-g139afe709a",
+        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-08-26-13-06/ffmpeg-n8.1.2-46-g139afe709a-linux64-gpl-8.1.tar.xz",
+        "sha256": "0814f4491c2673ea505be8fb65a76c2bfabaa5aad8f33d49b1c5b87a2262e8c5"
       },
       "aria2c": {
         "version": "1.37.0",

package-lock.json

@@ -25,7 +25,7 @@
         "@tauri-apps/plugin-notification": "^2.3.3",
         "@tauri-apps/plugin-opener": "^2",
         "i18next": "^26.4.0",
-        "lucide-react": "^1.33.0",
+        "lucide-react": "^1.34.0",
         "react": "^19.2.8",
         "react-dom": "^19.2.8",
         "react-i18next": "^17.0.12",
@@ -2122,9 +2122,9 @@
       }
     },
     "node_modules/lucide-react": {
-      "version": "1.33.0",
-      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.33.0.tgz",
-      "integrity": "sha512-MTRwMy0ZlL8Ur/vOAiJ9XGHE+kFPC7brq6MxAm0GiGXEBj0qy0jA/pG4N675oSzciO/UCdX8T+5yUQdmDeTLxg==",
+      "version": "1.34.0",
+      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.34.0.tgz",
+      "integrity": "sha512-vnjGJNI7Htk5+oWW8gXGuaLgwgAb0T6/iZbBrp9JCfRFwdNWZ0YTm3eyxjOLgwN6r8iyAf3UA70zNmBRBNv7yg==",
       "license": "ISC",
       "peerDependencies": {
         "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0"

package.json

@@ -60,7 +60,7 @@
     "@tauri-apps/plugin-notification": "^2.3.3",
     "@tauri-apps/plugin-opener": "^2",
     "i18next": "^26.4.0",
-    "lucide-react": "^1.33.0",
+    "lucide-react": "^1.34.0",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "react-i18next": "^17.0.12",

scripts/release-workflow.node-test.js

@@ -15,3 +15,11 @@ test('release Linux dependency installation is mirror-normalized and bounded', (
   assert.equal((releaseWorkflow.match(/timeout --foreground --signal=TERM --kill-after=30s 10m apt-get/g) || []).length, 2);
   assert.doesNotMatch(releaseWorkflow, /^\s*sudo apt-get (update|install)/m);
 });
+
+test('macOS release verification uses the app mounted from the final DMG', () => {
+  assert.match(releaseWorkflow, /npm run verify:macos-signing -- --dmg "\$DMG"/);
+  assert.match(releaseWorkflow, /hdiutil attach -nobrowse -readonly -mountpoint "\$MOUNT_POINT" "\$DMG"/);
+  assert.match(releaseWorkflow, /find "\$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink\.app'/);
+  assert.match(releaseWorkflow, /node scripts\/verify-binaries\.js --search-root "\$APP"/);
+  assert.doesNotMatch(releaseWorkflow, /verify:macos-signing -- --app "\$APP" --dmg/);
+});

src-tauri/Cargo.lock

@@ -659,9 +659,9 @@ checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
 
 [[package]]
 name = "combine"
-version = "4.6.7"
+version = "4.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+checksum = "cfc320937d09e6de266b31b9afb480f197d7a861be86be7cb2ea7e5d1bfffc5e"
 dependencies = [
  "bytes",
  "memchr",
@@ -3278,9 +3278,9 @@ checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
 name = "open"
-version = "5.4.1"
+version = "5.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9cfef937e9c486488c7e3d949ae31c0f1d06bdacd75b99c086cb35356e30408"
+checksum = "ade3be4664bc1ef537ce133015f04c176b737815c2ba9fd60edf212d6e90dd55"
 dependencies = [
  "dunce",
  "is-wsl",