Skip to content

Audit CI fix, RUSTSEC advisories - #15282

Merged
Legend-Master merged 6 commits into
tauri-apps:devfrom
sftse:audit-fix
Apr 23, 2026
Merged

Audit CI fix, RUSTSEC advisories#15282
Legend-Master merged 6 commits into
tauri-apps:devfrom
sftse:audit-fix

Conversation

@sftse

@sftse sftse commented Apr 22, 2026

Copy link
Copy Markdown
Contributor

Related to #15215 , unblocks activating branch protection.

Fixes #15227, fixes #15228, fixes #15229, fixes #15248, fixes #15249

The remaining advisories are triaged and ignored in CI for now.

2024-0429 glib 0.18.5 unsoundness, fixed by moving to gtk4
2026-0097 rand unsoundness, fixed by removing kuchikiki from deps in v3 --> have to skip because remains in lockfile, but is no longer a dependency of the default configuration, so can close #15227.
2026-0049 rustls, fixed by updating apple-codesign to 0.28.0
2026-0098 rustls, fixed by updating apple-codesign to 0.28.0
2026-0099 rustls, fixed by updating apple-codesign to 0.28.0

Updating apple-codesign would deal with #15244, #15245, #15246, #15247

@sftse
sftse requested a review from a team as a code owner April 22, 2026 14:24
@github-actions

github-actions Bot commented Apr 22, 2026

Copy link
Copy Markdown
Contributor

Package Changes Through ab4f32d

There are 11 changes which include tauri with minor, @tauri-apps/api with minor, tauri-build with minor, tauri-macos-sign with patch, tauri-bundler with minor, @tauri-apps/cli with minor, tauri-cli with minor, tauri-runtime with minor, tauri-runtime-wry with minor, tauri-utils with minor, tauri-plugin with minor

Planned Package Versions

The following package releases are the planned based on the context of changes in this pull request.

package current next
@tauri-apps/api 2.10.1 2.11.0
tauri-utils 2.8.3 2.9.0
tauri-macos-sign 2.3.3 2.3.4
tauri-bundler 2.8.1 2.9.0
tauri-runtime 2.10.1 2.11.0
tauri-runtime-wry 2.10.1 2.11.0
tauri-codegen 2.5.5 2.5.6
tauri-macros 2.5.5 2.5.6
tauri-plugin 2.5.4 2.6.0
tauri-build 2.5.6 2.6.0
tauri 2.10.3 2.11.0
@tauri-apps/cli 2.10.1 2.11.0
tauri-cli 2.10.1 2.11.0

Add another change file through the GitHub UI by following this link.


Read about change files or the docs at github.com/jbolda/covector

@Legend-Master

Copy link
Copy Markdown
Contributor

We have a config file https://github.com/tauri-apps/tauri/blob/dev/.cargo/audit.toml for the audits, so maybe use that instead

Full list
2024-0429 glib 0.18.5 unsoundness, fixed by moving to gtk4
2026-0097 rand unsoundness, fixed by removing kuchikiki from deps in v3
2026-0049 rustls, fixed by updating apple-codesign to 0.28.0
2026-0098 rustls, fixed by updating apple-codesign to 0.28.0
2026-0099 rustls, fixed by updating apple-codesign to 0.28.0

@Legend-Master Legend-Master left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks

@Legend-Master
Legend-Master merged commit fc1b52c into tauri-apps:dev Apr 23, 2026
9 checks passed
@sftse
sftse deleted the audit-fix branch April 23, 2026 03:47
razein97 pushed a commit to razein97/tauri that referenced this pull request Apr 30, 2026
* build: bump rustls-webpki because RUSTSEC advisory

* build: bump scc, sdd to not use yanked versions

* build: bump rand 0.8.x because RUSTSEC advisory

* build: bump rand 0.9.x to skip yanked version

* build: ignore RUSTSEC advisories until we can upgrade

Full list
2024-0429 glib 0.18.5 unsoundness, fixed by moving to gtk4
2026-0097 rand unsoundness, fixed by removing kuchikiki from deps in v3
2026-0049 rustls, fixed by updating apple-codesign to 0.28.0
2026-0098 rustls, fixed by updating apple-codesign to 0.28.0
2026-0099 rustls, fixed by updating apple-codesign to 0.28.0

* fmt audit.toml
razein97 pushed a commit to razein97/tauri that referenced this pull request Apr 30, 2026
* build: bump rustls-webpki because RUSTSEC advisory

* build: bump scc, sdd to not use yanked versions

* build: bump rand 0.8.x because RUSTSEC advisory

* build: bump rand 0.9.x to skip yanked version

* build: ignore RUSTSEC advisories until we can upgrade

Full list
2024-0429 glib 0.18.5 unsoundness, fixed by moving to gtk4
2026-0097 rand unsoundness, fixed by removing kuchikiki from deps in v3
2026-0049 rustls, fixed by updating apple-codesign to 0.28.0
2026-0098 rustls, fixed by updating apple-codesign to 0.28.0
2026-0099 rustls, fixed by updating apple-codesign to 0.28.0

* fmt audit.toml
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment