Track Tauri GTK upgrade to remediate glib advisory

Start with standalone/src-tauri/Cargo.lock and monitor Tauri releases for a v2 update that moves Linux GTK to a line resolving glib >= 0.20. When available, update the Tauri dependency, regenerate the Cargo disclosure, and verify the Linux standalone build; otherwise document the supported GTK4/v3 migration path instead of forcing glib.

Problem

Dependabot alert 1 tracks glib 0.18.5 (GHSA-wrw7-89jp-8q8g / RUSTSEC-2024-0429)
in standalone/src-tauri/Cargo.lock. The affected crate is a Linux-only
transitive dependency:

tauri 2.11.5 -> gtk 0.18.2 -> glib 0.18.5

cargo update -p glib --precise 0.20.0 cannot resolve while Tauri declares
gtk = "0.18"; this is not a lockfile-only update. PR #662 fixes the separate
serde_with alert and deliberately leaves this one open.

Current upstream state

Tauri v2.11.5 still declares GTK 0.18 for Linux:

• https://github.com/tauri-apps/tauri/blob/tauri-v2.11.5/crates/tauri/Cargo.toml#L99-L102

However, the earlier assumption that GTK3 bindings had no upgrade path is no
longer current. gtk3-rs 0.19.0 was released on 2026-09-08 and depends on the
gtk-rs-core 0.22 line, as recorded by its maintainer in the upstream Tauri
discussion. A Tauri upgrade from GTK 0.18 to 0.19 may therefore clear this
alert without waiting for Tauri 3, but it needs an upstream Tauri release and
compatibility validation.

Upstream tracking

• https://github.com/tauri-apps/tauri/issues/12048 — original advisory report;
  closed as Tauri cannot fix the GTK3 dependency alone.
• https://github.com/tauri-apps/tauri/issues/12564 — GTK3 binding maintenance
  and Tauri's GTK4/v3 direction; its latest comments record the 0.19.0 release.

Exit criteria

• Monitor Tauri releases for a v2 update that moves the Linux GTK dependency to
  a line resolving glib >= 0.20.
• When available, update the Tauri dependency, regenerate the Cargo disclosure,
  and verify the Linux standalone build.
• If Tauri does not adopt the GTK3 0.19 line, evaluate its supported GTK4/v3
  migration path separately rather than forcing glib in Dormouse's lockfile.