Track Tauri GTK upgrade to remediate glib advisory
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 4/5
- Tiempo estimado
- 3-5 días
- Aptitud para principiantes
- 35/100
Línea de trabajo
Start with standalone/src-tauri/Cargo.lock and monitor Tauri releases for a v2 update that moves Linux GTK to a line resolving glib >= 0.20. When available, update the Tauri dependency, regenerate the Cargo disclosure, and verify the Linux standalone build; otherwise document the supported GTK4/v3 migration path instead of forcing glib.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
Problem
Dependabot alert 1 tracks glib 0.18.5 (GHSA-wrw7-89jp-8q8g / RUSTSEC-2024-0429)
in standalone/src-tauri/Cargo.lock. The affected crate is a Linux-only
transitive dependency:
tauri 2.11.5 -> gtk 0.18.2 -> glib 0.18.5
cargo update -p glib --precise 0.20.0 cannot resolve while Tauri declares
gtk = "0.18"; this is not a lockfile-only update. PR #662 fixes the separate
serde_with alert and deliberately leaves this one open.
Current upstream state
Tauri v2.11.5 still declares GTK 0.18 for Linux:
However, the earlier assumption that GTK3 bindings had no upgrade path is no
longer current. gtk3-rs 0.19.0 was released on 2026-09-08 and depends on the
gtk-rs-core 0.22 line, as recorded by its maintainer in the upstream Tauri
discussion. A Tauri upgrade from GTK 0.18 to 0.19 may therefore clear this
alert without waiting for Tauri 3, but it needs an upstream Tauri release and
compatibility validation.
Upstream tracking
- https://github.com/tauri-apps/tauri/issues/12048 — original advisory report;
closed as Tauri cannot fix the GTK3 dependency alone. - https://github.com/tauri-apps/tauri/issues/12564 — GTK3 binding maintenance
and Tauri's GTK4/v3 direction; its latest comments record the 0.19.0 release.
Exit criteria
- Monitor Tauri releases for a v2 update that moves the Linux GTK dependency to
a line resolvingglib >= 0.20. - When available, update the Tauri dependency, regenerate the Cargo disclosure,
and verify the Linux standalone build. - If Tauri does not adopt the GTK3 0.19 line, evaluate its supported GTK4/v3
migration path separately rather than forcingglibin Dormouse's lockfile.
- Lenguaje dominante
- TypeScript
- Estrellas
- 5
- Forks
- 1
- Merge medio
- 18 h 26 min
- PR fusionados (30 d)
- 229
Guía de contribución
No hay ninguna guía de contribución indexada para este repositorio
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de diffplug/dormouse
-
Dificultad 4/5 3-5 días Aptitud para principiantes 35/100
-
Dificultad 4/5 3-5 días Aptitud para principiantes 35/100
-
Dificultad 4/5 3-5 días Aptitud para principiantes 25/100
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 45/100
-
Dificultad 4/5 3-5 días Aptitud para principiantes 25/100
Todos los issues de diffplug/dormouse
Issues similares
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 84/100
copse-dev/agent-pane#2953 ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 84/100
Eynzof/Hermes-CN-Desktop#610 ·
-
[Bug]: Matrix progress drafts fail with "Matrix runtime not initialized" during tool activity Abiertobug clawsweeper:linked-pr-open clawsweeper:needs-live-repro clawsweeper:no-new-fix-pr impact:message-loss issue-rating: 🐚 platinum hermit P2 regression
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
-
Client support matrix inclusion Abiertoenhancement
Dificultad 2/5 1-3 horas Aptitud para principiantes 68/100
-
calcite-components needs triage refactor
Dificultad 2/5 1-3 horas Aptitud para principiantes 75/100
Esri/calcite-design-system#15203 ·