chore(deps): Tauri 2.12.5, rustls, webpki and other Rust security fixes #46

2026-10-25T23:46:22-04:00

jared commented

2026-10-25 23:46:22 -04:00

Checking src-tauri/Cargo.lock against the OSV database (583 crates) flagged 44 entries. This updates the ones that ship in the app. Lockfile only; no code changes.

Crate	Was	Now	Why
tauri (and runtime, wry, macros, utils, which have to move together)	2.10.3	2.12.5	GHSA-7gmj-67g7-phm9: origin confusion lets remote pages invoke local-only IPC commands (fixed in 2.11.1). We show remote content in widgets and the call page.
rustls	0.23.37	0.23.46	TLS 1.3 handshake messages accepted across encryption levels; unauthenticated ServerHello downgrade; secrets in `Debug`; 1 GiB Brotli cert allocation
rustls-webpki	0.103.10	0.103.16	Name constraints wrongly accepted; distrusted intermediates accepted; CRL panic
webpki-root-certs	1.0.6	1.0.11	Drops the distrusted emSign roots
tar	0.4.45	0.4.46	PAX header desync
tokio, anyhow, event-listener, serde_with		latest compatible	Soundness fixes

rustls and webpki matter here because they verify TLS for the auto-updater's downloads.

Left as is, and why

zip 4: a build-time dependency only; nothing in the shipped app uses it.
quick-xml: comes through plist in tauri-utils, which is already the latest version, at compile time.
glib 0.18: the GTK3 bindings Tauri uses on Linux, so it waits on upstream.
rand: unsound only with a custom logger, which we don't use.
Unmaintained notices: fxhash, proc-macro-error, zbus_names, zvariant.

After this, OSV reports 20 entries, all in that list.

Tested

cargo check --locked passes on Linux (WebKitGTK 2.50).
First try: pinning only tauri to 2.11.1 failed to compile against a newer tauri-runtime. Updating the family together with --recursive fixed it.
The Windows smoke workflow was started on this branch (a full NSIS build, then install, boot, keychain, deep links, IPC and update-over-running-app). I'll merge only if it passes.

Note: merging to main triggers the release build, so this ships as the next nightly.

🤖 Generated with Claude Code

https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

Checking `src-tauri/Cargo.lock` against the OSV database (583 crates) flagged 44 entries. This updates the ones that ship in the app. **Lockfile only; no code changes.** | Crate | Was | Now | Why | |---|---|---|---| | tauri (and runtime, wry, macros, utils, which have to move together) | 2.10.3 | **2.12.5** | GHSA-7gmj-67g7-phm9: origin confusion lets **remote pages invoke local-only IPC commands** (fixed in 2.11.1). We show remote content in widgets and the call page. | | rustls | 0.23.37 | **0.23.46** | TLS 1.3 handshake messages accepted across encryption levels; unauthenticated ServerHello downgrade; secrets in `Debug`; 1 GiB Brotli cert allocation | | rustls-webpki | 0.103.10 | **0.103.16** | Name constraints wrongly accepted; distrusted intermediates accepted; CRL panic | | webpki-root-certs | 1.0.6 | **1.0.11** | Drops the distrusted emSign roots | | tar | 0.4.45 | 0.4.46 | PAX header desync | | tokio, anyhow, event-listener, serde_with | | latest compatible | Soundness fixes | rustls and webpki matter here because they verify TLS for the **auto-updater's** downloads. **Left as is, and why** - **zip 4:** a build-time dependency only; nothing in the shipped app uses it. - **quick-xml:** comes through `plist` in `tauri-utils`, which is already the latest version, at compile time. - **glib 0.18:** the GTK3 bindings Tauri uses on Linux, so it waits on upstream. - **rand:** unsound only with a custom logger, which we don't use. - **Unmaintained notices:** fxhash, proc-macro-error, zbus_names, zvariant. After this, OSV reports 20 entries, all in that list. **Tested** - `cargo check --locked` passes on Linux (WebKitGTK 2.50). - First try: pinning only `tauri` to 2.11.1 failed to compile against a newer `tauri-runtime`. Updating the family together with `--recursive` fixed it. - The **Windows smoke workflow** was started on this branch (a full NSIS build, then install, boot, keychain, deep links, IPC and update-over-running-app). I'll merge only if it passes. **Note:** merging to `main` triggers the release build, so this ships as the next nightly. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared added 1 commit 2026-10-25 23:46:22 -04:00

chore(deps): Tauri 2.12.5, rustls 0.23.46, rustls-webpki 0.103.16 and other Rust security fixes 3f7d00a965

OSV flagged the desktop crates; the ones that ship in the app:
- tauri 2.10.3: origin confusion lets remote pages invoke local-only IPC
  commands (GHSA-7gmj-67g7-phm9, fixed in 2.11.1). The whole Tauri family
  moves together (2.12.5 / runtime 2.12.2 / macros 2.7.4 / utils 2.10.2).
- rustls 0.23.37: TLS 1.3 handshake messages across encryption levels,
  ServerHello downgrade, secrets in Debug, Brotli cert allocation.
- rustls-webpki 0.103.10: name constraints, distrusted intermediates, CRL
  panic. webpki-root-certs 1.0.11 drops the distrusted emSign roots.
- tar 0.4.46 (PAX desync), tokio 1.54.1, anyhow, event-listener, serde_with.

Left: zip 4 (build-time only), quick-xml (via plist in tauri-utils, already
latest), glib 0.18 (GTK3 bindings Tauri uses), rand (custom-logger only),
unmaintained notices. cargo check --locked passes on Linux.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared added 1 commit 2026-10-26 00:34:39 -04:00

fix(deps): move webview2-com to 0.39 and windows to 0.62 to match wry 0.57 e3bc4e128f

The Tauri update brought wry 0.57, which uses webview2-com 0.39 / windows
0.62. Our Windows-only permission handler (lib.rs) still used webview2-com
0.38, so its handler type did not satisfy wry's ICoreWebView2 bound (E0277
on the Windows build).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared added 1 commit 2026-10-26 01:59:35 -04:00

fix(ipc): declare the app commands and grant them to the app origin (Tauri 2.11+ ACL) 7fecf72107

With Tauri 2.12 every app command was refused ("Command … not allowed by
ACL"): the app is served from http://localhost:44548 (tauri-plugin-
localhost), which Tauri treats as a remote origin, and since the
GHSA-7gmj-67g7-phm9 fix app commands need an explicit capability. The
Windows smoke test caught it (keychain, hotkeys, tray/taskbar/thumbbar,
token migration all failed).

build.rs now declares the 35 commands as an app manifest, and
capabilities/migrated.json (scoped to http://localhost:44548 only) grants
allow-<command> for each. The call page (http://127.0.0.1:44548) and any
remote frame still get no IPC. gen/schemas regenerated by tauri-build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared commented

2026-10-26 02:31:08 -04:00

The Windows smoke test caught two problems; both are fixed, and it now passes (run 2898: 12 passed, 0 failed).

Build failure (run 2890). wry 0.57 uses webview2-com 0.39 and windows 0.62, but our Windows permission handler still used webview2-com 0.38, so its handler type didn't satisfy wry's ICoreWebView2 (E0277). Fixed by moving our pins to 0.39 and 0.62 (e3bc4e1).
Every app command refused (run 2897): "Command … not allowed by ACL".
- Cause: the app is served from http://localhost:44548, which Tauri treats as a remote origin. Since the GHSA-7gmj fix, app commands need an explicit capability.
- Fix (7fecf72): build.rs declares the 35 commands as an app manifest, and capabilities/migrated.json (scoped to http://localhost:44548 only) grants allow-<command> for each.
- Isolation is unchanged: the call page (http://127.0.0.1:44548) and remote frames still get no IPC.

Run 2898 results

Passed: keychain round trip, the tray/badge/taskbar/thumbbar/media commands, deep links, update over the running app, call-page storage isolation, and the microphone refused to a foreign page.
n/a, as before: global hotkeys (the runner has no desktop session) and token migration ("before step 2").

Merging now. This ships as the next nightly.

🤖 Generated with Claude Code

**The Windows smoke test caught two problems; both are fixed, and it now passes (run 2898: 12 passed, 0 failed).** 1. **Build failure (run 2890).** wry 0.57 uses `webview2-com` 0.39 and `windows` 0.62, but our Windows permission handler still used `webview2-com` 0.38, so its handler type didn't satisfy wry's `ICoreWebView2` (E0277). Fixed by moving our pins to 0.39 and 0.62 (`e3bc4e1`). 2. **Every app command refused (run 2897):** "Command … not allowed by ACL". - **Cause:** the app is served from `http://localhost:44548`, which Tauri treats as a remote origin. Since the GHSA-7gmj fix, app commands need an explicit capability. - **Fix (`7fecf72`):** `build.rs` declares the 35 commands as an app manifest, and `capabilities/migrated.json` (scoped to `http://localhost:44548` only) grants `allow-<command>` for each. - **Isolation is unchanged:** the call page (`http://127.0.0.1:44548`) and remote frames still get no IPC. **Run 2898 results** - **Passed:** keychain round trip, the tray/badge/taskbar/thumbbar/media commands, deep links, update over the running app, call-page storage isolation, and the microphone refused to a foreign page. - **n/a, as before:** global hotkeys (the runner has no desktop session) and token migration ("before step 2"). **Merging now.** This ships as the next nightly. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jared merged commit fb4cc84087 into main

2026-10-26 02:31:09 -04:00

jared referenced this pull request

2026-10-26 03:18:55 -04:00

ci(smoke): wait for the keychain strip before judging #105 step 2 #47

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/cinny-desktop#46