LotusGuild/cinny-desktop
3
0
Fork 0
Code Issues 12 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

chore(deps): Tauri 2.12.5, rustls, webpki and other Rust security fixes #46

Merged
jared merged 3 commits from chore/rust-security-deps into main 2026-10-26 02:31:09 -04:00
Conversation 1 Commits 3 Files Changed 8
+2332 -9309
3 Commits
Author SHA1 Message Date
Lotus CIandClaude Opus 5.5 7fecf72107 fix(ipc): declare the app commands and grant them to the app origin (Tauri 2.11+ ACL) 
With Tauri 2.12 every app command was refused ("Command … not allowed by
ACL"): the app is served from http://localhost:44548 (tauri-plugin-
localhost), which Tauri treats as a remote origin, and since the
GHSA-7gmj-67g7-phm9 fix app commands need an explicit capability. The
Windows smoke test caught it (keychain, hotkeys, tray/taskbar/thumbbar,
token migration all failed).

build.rs now declares the 35 commands as an app manifest, and
capabilities/migrated.json (scoped to http://localhost:44548 only) grants
allow-<command> for each. The call page (http://127.0.0.1:44548) and any
remote frame still get no IPC. gen/schemas regenerated by tauri-build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
 2026-10-26 01:59:33 -04:00
Lotus CIandClaude Opus 5.5 e3bc4e128f fix(deps): move webview2-com to 0.39 and windows to 0.62 to match wry 0.57 
The Tauri update brought wry 0.57, which uses webview2-com 0.39 / windows
0.62. Our Windows-only permission handler (lib.rs) still used webview2-com
0.38, so its handler type did not satisfy wry's ICoreWebView2 bound (E0277
on the Windows build).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
 2026-10-26 00:34:36 -04:00
Lotus CIandClaude Opus 5.5 3f7d00a965 chore(deps): Tauri 2.12.5, rustls 0.23.46, rustls-webpki 0.103.16 and other Rust security fixes 
OSV flagged the desktop crates; the ones that ship in the app:
- tauri 2.10.3: origin confusion lets remote pages invoke local-only IPC
  commands (GHSA-7gmj-67g7-phm9, fixed in 2.11.1). The whole Tauri family
  moves together (2.12.5 / runtime 2.12.2 / macros 2.7.4 / utils 2.10.2).
- rustls 0.23.37: TLS 1.3 handshake messages across encryption levels,
  ServerHello downgrade, secrets in Debug, Brotli cert allocation.
- rustls-webpki 0.103.10: name constraints, distrusted intermediates, CRL
  panic. webpki-root-certs 1.0.11 drops the distrusted emSign roots.
- tar 0.4.46 (PAX desync), tokio 1.54.1, anyhow, event-listener, serde_with.

Left: zip 4 (build-time only), quick-xml (via plist in tauri-utils, already
latest), glib 0.18 (GTK3 bindings Tauri uses), rand (custom-logger only),
unmaintained notices. cargo check --locked passes on Linux.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
 2026-10-25 23:46:01 -04:00