Sync upstream and integrate GTK4/WebKitGTK 6 ports

.cargo/audit.toml

@@ -11,8 +11,4 @@ ignore = [
   "RUSTSEC-2026-0097",
   # glib 0.18.5 unsoundness, fixed by updating to gtk4
   "RUSTSEC-2024-0429",
-  # quick-xml, need an update in plist
-  "RUSTSEC-2026-0194",
-  # quick-xml, need an update in plist
-  "RUSTSEC-2026-0195",
 ]

.changes/android-compileroptions-dsl.md

@@ -0,0 +1,9 @@
+---
+"tauri": patch:enhance
+"tauri-cli": patch:enhance
+"@tauri-apps/cli": patch:enhance
+---
+
+Migrate the Android Gradle scripts from the deprecated `kotlinOptions` DSL to `compilerOptions`, which is accepted by both Kotlin Gradle Plugin 1.9.x and 2.x. This lets projects move to Kotlin 2.x without hitting the hard error that 2.3+ raises on the old DSL.
+
+This increased the minimum supported Gradle version to 8.13. If your Gradle version is earlier, delete `src-tauri/gen/android/gradle/wrapper/gradle-wrapper.properties` and re-run `tauri android init` to update it.

.changes/android-material3.md

@@ -0,0 +1,6 @@
+---
+"tauri-cli": patch:enhance
+"@tauri-apps/cli": patch:enhance
+---
+
+Use `Theme.Material3.DayNight.NoActionBar` instead of `Theme.MaterialComponents.DayNight.NoActionBar` when running `tauri android init`

.changes/app-bound-domains.md

@@ -0,0 +1,8 @@
+---
+"tauri": minor:feat
+"tauri-runtime": minor:feat
+"tauri-runtime-wry": minor:feat
+"tauri-utils": minor:feat
+---
+
+Add `WebviewBuilder::limit_navigations_to_app_bound_domains`, `WebviewWindowBuilder::limit_navigations_to_app_bound_domains`, and limitNavigationsToAppBoundDomains to tauri.config.json.

.changes/bundler-show-sizes.md

@@ -0,0 +1,7 @@
+---
+"tauri-bundler": "minor:feat"
+"tauri-cli": "minor:feat"
+"@tauri-apps/cli": "minor:feat"
+---
+
+The bundler now prints the size of each generated bundle next to its path in the `Finished N bundles at:` output (directories such as macOS `.app` bundles are measured recursively).

.changes/cleanup-js-menu-channel.md

@@ -0,0 +1,5 @@
+---
+"tauri": "patch:bug"
+---
+
+Remove the `Channel` used to send events to the JavaScript side when the menu is dropped.

.changes/fix-wix-resource-target-name.md

@@ -0,0 +1,8 @@
+---
+"tauri-bundler": patch:bug
+"tauri-cli": patch:bug
+"@tauri-apps/cli": patch:bug
+---
+
+
+Fix the WiX bundler so it respects the resource's target file name.

.changes/resolved-command-reference-debug-assertion.md

@@ -0,0 +1,8 @@
+---
+tauri: minor:enhance
+tauri-macros: minor:enhance
+tauri-utils: minor:enhance
+tauri-build: minor:enhance
+---
+
+Fix compilation errors when `tauri-utils` is built with different debug-assertion settings for the build and runtime profiles.

.changes/tauri-info-skip-rust-only-js.md

@@ -0,0 +1,6 @@
+---
+"tauri-cli": "patch:bug"
+"@tauri-apps/cli": "patch:bug"
+---
+
+Prevent `tauri info` from reporting Rust-only plugins as having a missing npm package.

.changes/wry-callback-sync.md

@@ -0,0 +1,6 @@
+---
+"tauri": minor:breaking
+"tauri-runtime": minor:breaking
+---
+
+Require webview navigation, IPC, page-load, and document-title callbacks to be `Sync` in addition to `Send`, matching the thread-safety contract of the vendored Wry runtime.

.github/workflows/audit.yml

@@ -48,7 +48,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 'lts/*'
       - run: corepack enable

.github/workflows/bench.yml

@@ -50,12 +50,13 @@ jobs:
           components: rust-src
           targets: ${{ matrix.platform.target }}
 
-      - name: install webkit2gtk and xvfb (ubuntu only)
+      - name: install WebKitGTK and xvfb (ubuntu only)
         if: contains(matrix.platform.target, 'gnu')
         run: |
+          sudo find /etc/apt/sources.list.d -maxdepth 1 -type f -exec grep -l "packages.microsoft.com" {} \; | xargs -r sudo rm -f
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
-            webkit2gtk-4.1 libayatana-appindicator3-dev \
+            libgtk-4-dev libwebkitgtk-6.0-dev libdbus-1-dev \
             xvfb \
             at-spi2-core
 
@@ -86,11 +87,13 @@ jobs:
           cargo +nightly build --release -Z build-std=std,panic_abort -Z build-std-features= --target ${{ matrix.platform.target }} --manifest-path bench/tests/helloworld/src-tauri/Cargo.toml
 
       - name: run benchmarks
+        env:
+          WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS: ${{ contains(matrix.platform.target, 'gnu') && '1' || '' }}
         run: ${{ matrix.platform.runner }}cargo run --manifest-path ./bench/Cargo.toml --bin run_benchmark
 
       - name: clone benchmarks_results
         if: github.repository == 'tauri-apps/tauri' && github.ref == 'refs/heads/dev'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           token: ${{ secrets.ORG_TAURI_BOT_PAT }}
           path: gh-pages

.github/workflows/check-change-tags.yml

@@ -17,7 +17,9 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: check change files end with .md
         run: |

.github/workflows/check-generated-files.yml

@@ -26,7 +26,9 @@ jobs:
       api: ${{ steps.filter.outputs.api }}
       schema: ${{ steps.filter.outputs.schema }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: dorny/paths-filter@v3
         id: filter
         with:
@@ -45,9 +47,13 @@ jobs:
     needs: changes
     if: needs.changes.outputs.api == 'true'
     steps:
-      - uses: actions/checkout@v4
-      - run: npm i -g --force corepack
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - run: |
+          npm i -g --force corepack@0.34.0
+          corepack enable pnpm
+      - uses: actions/setup-node@v7
         with:
           node-version: 'lts/*'
           cache: 'pnpm'
@@ -65,15 +71,18 @@ jobs:
     needs: changes
     if: needs.changes.outputs.schema == 'true'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: install stable
         uses: dtolnay/rust-toolchain@stable
 
       - name: install Linux dependencies
         run: |
+          sudo find /etc/apt/sources.list.d -maxdepth 1 -type f -exec grep -l "packages.microsoft.com" {} \; | xargs -r sudo rm -f
           sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev
+          sudo apt-get install -y libgtk-4-dev
 
       - uses: Swatinem/rust-cache@v2
 

.github/workflows/check-license-header.yml

@@ -15,7 +15,9 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: dorny/paths-filter@v3
         id: filter
         with:

.github/workflows/covector-status.yml

@@ -10,9 +10,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: covector status
         uses: jbolda/covector/packages/action@covector-v0
         id: covector

.github/workflows/covector-version-or-publish.yml

@@ -19,14 +19,16 @@ jobs:
         platform: [ubuntu-latest, macos-latest, windows-latest]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
-      - run: npm i -g --force corepack
-      - uses: actions/setup-node@v4
+      - run: |
+          npm i -g --force corepack@0.34.0
+          corepack enable pnpm
+      - uses: actions/setup-node@v7
         with:
-          node-version: 20
           cache: 'pnpm'
 
       - name: install stable
@@ -35,8 +37,9 @@ jobs:
       - name: install Linux dependencies
         if: matrix.platform == 'ubuntu-latest'
         run: |
+          sudo find /etc/apt/sources.list.d -maxdepth 1 -type f -exec grep -l "packages.microsoft.com" {} \; | xargs -r sudo rm -f
           sudo apt-get update
-          sudo apt-get install -y webkit2gtk-4.1 libayatana-appindicator3-dev libfuse2 librsvg2-dev
+          sudo apt-get install -y libgtk-4-dev libwebkitgtk-6.0-dev libdbus-1-dev libfuse2 librsvg2-dev
 
       - uses: Swatinem/rust-cache@v2
 
@@ -70,11 +73,14 @@ jobs:
       - run-integration-tests
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - run: npm i -g --force corepack
-      - uses: actions/setup-node@v6
+          persist-credentials: false
+      - run: |
+          npm i -g --force corepack@0.34.0
+          corepack enable pnpm
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
 
@@ -87,8 +93,9 @@ jobs:
 
       - name: install Linux dependencies
         run: |
+          sudo find /etc/apt/sources.list.d -maxdepth 1 -type f -exec grep -l "packages.microsoft.com" {} \; | xargs -r sudo rm -f
           sudo apt-get update
-          sudo apt-get install -y webkit2gtk-4.1 libayatana-appindicator3-dev librsvg2-dev
+          sudo apt-get install -y libgtk-4-dev libwebkitgtk-6.0-dev libdbus-1-dev librsvg2-dev
 
       - name: covector version or publish (publish when no change files present)
         uses: jbolda/covector/packages/action@covector-v0
@@ -108,7 +115,7 @@ jobs:
 
       - name: Create Pull Request With Versions Bumped
         if: steps.covector.outputs.commandRan == 'version'
-        uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # 7.0.6
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           branch: release/version-updates

.github/workflows/docker.yml

@@ -17,15 +17,18 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: install stable
         uses: dtolnay/rust-toolchain@stable
 
       - name: install Linux dependencies
         run: |
+          sudo find /etc/apt/sources.list.d -maxdepth 1 -type f -exec grep -l "packages.microsoft.com" {} \; | xargs -r sudo rm -f
           sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev
+          sudo apt-get install -y libgtk-4-dev
 
       - name: install cross
         run: cargo install cross --git https://github.com/cross-rs/cross
@@ -59,7 +62,9 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: install stable
         uses: dtolnay/rust-toolchain@stable
@@ -68,7 +73,7 @@ jobs:
 
       - run: npm i -g --force corepack
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 'lts/*'
 
@@ -85,20 +90,20 @@ jobs:
           path: 'examples/api'
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and export to Docker
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v7
         with:
           context: .docker/cross
           file: .docker/cross/${{ matrix.target.filename }}.Dockerfile
@@ -107,8 +112,9 @@ jobs:
 
       - name: install dependencies
         run: |
+          sudo find /etc/apt/sources.list.d -maxdepth 1 -type f -exec grep -l "packages.microsoft.com" {} \; | xargs -r sudo rm -f
           sudo apt-get update
-          sudo apt-get install -y webkit2gtk-4.1 libayatana-appindicator3-dev
+          sudo apt-get install -y libgtk-4-dev libwebkitgtk-6.0-dev libdbus-1-dev
 
       - name: Test
         run: |
@@ -122,7 +128,7 @@ jobs:
           ./cargo-tauri build --runner cross --bundles deb --target ${{ matrix.target.name }} --verbose
 
       - name: Build and push
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v7
         with:
           context: .docker/cross
           file: .docker/cross/${{ matrix.target.filename }}.Dockerfile

.github/workflows/fmt.yml

@@ -12,7 +12,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: install Rust stable and rustfmt
         uses: dtolnay/rust-toolchain@stable
@@ -25,9 +27,13 @@ jobs:
   prettier:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - run: npm i -g --force corepack
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - run: |
+          npm i -g --force corepack@0.34.0
+          corepack enable pnpm
+      - uses: actions/setup-node@v7
         with:
           node-version: 'lts/*'
           cache: 'pnpm'
@@ -38,7 +44,9 @@ jobs:
     name: taplo (.toml files)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: install Rust stable
         uses: dtolnay/rust-toolchain@stable