Track Tauri GTK upgrade to remediate glib advisory
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
Research direction
Start with standalone/src-tauri/Cargo.lock and monitor Tauri releases for a v2 update that moves Linux GTK to a line resolving glib >= 0.20. When available, update the Tauri dependency, regenerate the Cargo disclosure, and verify the Linux standalone build; otherwise document the supported GTK4/v3 migration path instead of forcing glib.
Written by the indexing model from the issue text.
Description
Problem
Dependabot alert 1 tracks glib 0.18.5 (GHSA-wrw7-89jp-8q8g / RUSTSEC-2024-0429)
in standalone/src-tauri/Cargo.lock. The affected crate is a Linux-only
transitive dependency:
tauri 2.11.5 -> gtk 0.18.2 -> glib 0.18.5
cargo update -p glib --precise 0.20.0 cannot resolve while Tauri declares
gtk = "0.18"; this is not a lockfile-only update. PR #662 fixes the separate
serde_with alert and deliberately leaves this one open.
Current upstream state
Tauri v2.11.5 still declares GTK 0.18 for Linux:
However, the earlier assumption that GTK3 bindings had no upgrade path is no
longer current. gtk3-rs 0.19.0 was released on 2026-09-08 and depends on the
gtk-rs-core 0.22 line, as recorded by its maintainer in the upstream Tauri
discussion. A Tauri upgrade from GTK 0.18 to 0.19 may therefore clear this
alert without waiting for Tauri 3, but it needs an upstream Tauri release and
compatibility validation.
Upstream tracking
- https://github.com/tauri-apps/tauri/issues/12048 — original advisory report;
closed as Tauri cannot fix the GTK3 dependency alone. - https://github.com/tauri-apps/tauri/issues/12564 — GTK3 binding maintenance
and Tauri's GTK4/v3 direction; its latest comments record the 0.19.0 release.
Exit criteria
- Monitor Tauri releases for a v2 update that moves the Linux GTK dependency to
a line resolvingglib >= 0.20. - When available, update the Tauri dependency, regenerate the Cargo disclosure,
and verify the Linux standalone build. - If Tauri does not adopt the GTK3 0.19 line, evaluate its supported GTK4/v3
migration path separately rather than forcingglibin Dormouse's lockfile.
- Dominant language
- TypeScript
- Stars
- 5
- Forks
- 1
- Avg merge
- 18h 26m
- Merged PRs (30d)
- 229
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from diffplug/dormouse
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 45/100
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
All issues in diffplug/dormouse
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#610 ·
-
bug clawsweeper:linked-pr-open clawsweeper:needs-live-repro clawsweeper:no-new-fix-pr impact:message-loss issue-rating: 🐚 platinum hermit P2 regression
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100
fullcalendar/fullcalendar#8106 ·