Track Tauri GTK upgrade to remediate glib advisory

Open
#663 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
linux, rust, tauri
Domain
desktop, security

Research direction

Start with standalone/src-tauri/Cargo.lock and monitor Tauri releases for a v2 update that moves Linux GTK to a line resolving glib >= 0.20. When available, update the Tauri dependency, regenerate the Cargo disclosure, and verify the Linux standalone build; otherwise document the supported GTK4/v3 migration path instead of forcing glib.

Written by the indexing model from the issue text.

Description

Problem

Dependabot alert 1 tracks glib 0.18.5 (GHSA-wrw7-89jp-8q8g / RUSTSEC-2024-0429)
in standalone/src-tauri/Cargo.lock. The affected crate is a Linux-only
transitive dependency:

tauri 2.11.5 -> gtk 0.18.2 -> glib 0.18.5

cargo update -p glib --precise 0.20.0 cannot resolve while Tauri declares
gtk = "0.18"; this is not a lockfile-only update. PR #662 fixes the separate
serde_with alert and deliberately leaves this one open.

Current upstream state

Tauri v2.11.5 still declares GTK 0.18 for Linux:

However, the earlier assumption that GTK3 bindings had no upgrade path is no
longer current. gtk3-rs 0.19.0 was released on 2026-09-08 and depends on the
gtk-rs-core 0.22 line, as recorded by its maintainer in the upstream Tauri
discussion. A Tauri upgrade from GTK 0.18 to 0.19 may therefore clear this
alert without waiting for Tauri 3, but it needs an upstream Tauri release and
compatibility validation.

Upstream tracking

Exit criteria

  • Monitor Tauri releases for a v2 update that moves the Linux GTK dependency to
    a line resolving glib >= 0.20.
  • When available, update the Tauri dependency, regenerate the Cargo disclosure,
    and verify the Linux standalone build.
  • If Tauri does not adopt the GTK3 0.19 line, evaluate its supported GTK4/v3
    migration path separately rather than forcing glib in Dormouse's lockfile.
Dominant language
TypeScript
Stars
5
Forks
1
Avg merge
18h 26m
Merged PRs (30d)
229

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from diffplug/dormouse

All issues in diffplug/dormouse

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.