chore(deps): Tauri 2.12.5, rustls 0.23.46, rustls-webpki 0.103.16 and other Rust security fixes

Browse Source

OSV flagged the desktop crates; the ones that ship in the app:
- tauri 2.10.3: origin confusion lets remote pages invoke local-only IPC
  commands (GHSA-7gmj-67g7-phm9, fixed in 2.11.1). The whole Tauri family
  moves together (2.12.5 / runtime 2.12.2 / macros 2.7.4 / utils 2.10.2).
- rustls 0.23.37: TLS 1.3 handshake messages across encryption levels,
  ServerHello downgrade, secrets in Debug, Brotli cert allocation.
- rustls-webpki 0.103.10: name constraints, distrusted intermediates, CRL
  panic. webpki-root-certs 1.0.11 drops the distrusted emSign roots.
- tar 0.4.46 (PAX desync), tokio 1.54.1, anyhow, event-listener, serde_with.

Left: zip 4 (build-time only), quick-xml (via plist in tauri-utils, already
latest), glib 0.18 (GTK3 bindings Tauri uses), rand (custom-logger only),
unmaintained notices. cargo check --locked passes on Linux.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

...

This commit is contained in:

Lotus CI

2026-10-25 23:46:01 -04:00

co-authored by Claude Opus 5.5

parent 25f852fc34

commit 3f7d00a965

1 changed files with 1020 additions and 824 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

src-tauri/Cargo.lock

Generated

+1020 -824

File diff suppressed because it is too large Load Diff