Sync upstream/dev (2026-08-09) by OlympusLedgerOrg · Pull Request #16 · OlympusLedgerOrg/tauri

OlympusLedgerOrg · 2026-08-09T12:36:11Z

Brings the fork up to date with tauri-apps/tauri:dev as of 2026-08-09 (9 commits, last sync was 2026-08-03 in #15).

Why this sync is small

Unlike #15 (32 commits, GTK4/WebKit6 port forward-port required), this sync doesn't touch crates/tauri-runtime-wry's tao/wry version requirements, so ports/tao and ports/wry needed no forward-porting. cargo metadata resolves both to their local paths with no patch-unused warnings.

Commits

206f4c0 — merge of upstream/dev (9 commits). Conflicts were limited to Cargo.lock, pnpm-lock.yaml, and pnpm-workspace.yaml overrides — all three because upstream independently added the same undici audit override the fork already carried locally (from 6e308a1, merged in Sync upstream/dev (2026-08-03) and forward-port ports/tao 0.36 / ports/wry 0.56 #15). Resolved by keeping the fork's full override set (brace-expansion, js-yaml, postcss, sharp, undici, ws) and regenerating both lockfiles.
0cfd10e — cargo update -p glob to 0.3.4. Upstream's glob bump (chore(deps): update rust crate glob to v0.3.4 tauri-apps/tauri#15826) changed glob::Pattern's Debug output (used in the ACL snapshot tests), but a workspace-wide cargo update didn't pick this crate up on its own, so the ACL snapshot tests failed until it was updated explicitly.

What's in the 9 upstream commits

fix(build): resolve target dir from OUT_DIR on new nightly
fix(runtime-wry): run_return() now returns the expected exit code
fix: make embedded assets codegen and config serialization deterministic
dependency bumps: glob 0.3.4, rollup 4.62.4, napi-rs packages, misc renovate/CI config
doc/changelog fixes

Validation

Ran locally since this environment can't cross-compile the Linux GTK4/WebKit6 stack from Windows the way #15's author could — but this container can build it natively (installed libgtk-4-dev, libwebkitgtk-6.0-dev, libadwaita-1-dev, libdbus-1-dev):

cargo check -p tauri-build -p tauri-codegen -p tauri-runtime-wry -p tauri-utils --all-features — clean, including a real compile of ports/tao (0.36.0) and ports/wry (0.56.0), no patch-unused warnings
cargo clippy -p tauri-build -p tauri-codegen -p tauri-runtime-wry -p tauri-utils --all-features --all-targets -- -D warnings — clean
cargo fmt --all -- --check — clean
cargo test -p tauri-utils config:: — 15 passed (covers the deterministic config serialization fix)
cargo test -p tauri-build — 10 passed (covers the OUT_DIR/target-dir fix)
cargo test -p acl-tests — passes after the glob bump; failed before it (stale snapshot mismatch)
pnpm install — lockfile passes supply-chain policy (522 entries), fork's audit overrides (brace-expansion, js-yaml, postcss, sharp, undici, ws) all still resolve to their patched versions

Not run here: full CI matrix (Windows/macOS targets, Android/iOS cross builds, bench suite) — left to CI.

Generated by Claude Code

Summary by CodeRabbit

Bug Fixes
- Applications now preserve requested exit codes when shutting down.
- Build outputs and generated configuration are serialized in a consistent order, improving reproducibility across builds.
- Resource and sidecar placement now works correctly with nightly toolchain directory layouts.
Chores
- Updated release documentation and internal tooling configuration.
- Improved safeguards for consistent package publishing and build validation.

* ci: remove renovate cli group name * bump napi-rs but auto cli packages * why prettier this time?

* chore(deps): update dependency vitest to v4.1.10 * Fix audit * override undici * bump log plugin to fix audit --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Tony <legendmastertony@gmail.com>

* chore(deps): update rust crate glob to v0.3.4 * update snapshots * fix mac and linux * take 3 --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Tony <legendmastertony@gmail.com>

…tic (tauri-apps#15777) * fix: make embedded assets codegen and config serialization deterministic generate_context! emitted the embedded asset map and the CSP script/style hashes in filesystem walk order (varies across machines) and HashMap iteration order (varies per process), and serializing the processed config wrote the csp/headers/plugins maps in HashMap iteration order. Both broke reproducible builds: the same source built on two machines produced different binaries and a different tauri.conf.json in the generated Android project. Iterate all of them sorted, complementing tauri-apps#14986 which sorted the same config maps on the ToTokens path. closes tauri-apps#14978 * Use `BTreeMap` for embedded assets and inline script hashes * remove outdated comment * Convert to BTreeMap instead of sort to vec --------- Co-authored-by: Tony <68118705+Legend-Master@users.noreply.github.com> Co-authored-by: Tony <legendmastertony@gmail.com>

…uri-apps#15821) * fix(runtime-wry): return the expected exit code from run_return() Transfer the exit code from the window.app_handle().exit(1) call to the run_return() result instead of always returning 0.

…s#15831) * fix(build): resolve target dir from OUT_DIR on new nightly * fix(build): clarify OUT_DIR comment and tidy up the new tests * fix(build): move the target dir TODO onto the helper and document the layouts --------- Co-authored-by: Lazizbek Ergashev <20501725+lazerg@users.noreply.github.com>

* chore(deps): update napi-rs packages * place napi groupng at the end * bump in cargo.toml * fix audit --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Tony <legendmastertony@gmail.com>

* chore(deps): update dependency rollup to v4.62.4 * bump nanoid for audit --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Tony <legendmastertony@gmail.com>

…6rwlz # Conflicts: # Cargo.lock # pnpm-lock.yaml # pnpm-workspace.yaml

… for ACL snapshot tests to pass after upstream sync)

coderabbitai · 2026-08-09T12:36:21Z

📝 Walkthrough

Walkthrough

The changes make configuration and embedded asset output deterministic, resolve target directories from varied OUT_DIR layouts, preserve application exit codes, and update audit, release, dependency, and Renovate metadata.

Changes

Build and release behavior

Layer / File(s)	Summary
Deterministic configuration serialization `crates/tauri-utils/src/config.rs`, `.changes/fix-deterministic-config-serialization.md`	Custom serializers now order CSP, header source, and plugin configuration maps through `BTreeMap` views.
Deterministic embedded asset code generation `crates/tauri-codegen/src/embedded_assets.rs`, `.changes/fix-deterministic-embedded-assets-codegen.md`	Embedded assets and CSP hashes now use ordered collections and sorted emission.
Target directory and exit-code handling `crates/tauri-build/src/lib.rs`, `crates/tauri-runtime-wry/src/lib.rs`, `.changes/target-dir-nightly-out-dir.md`, `.changes/exit-with-code.md`	Target directories are resolved by searching `OUT_DIR` ancestors. Runtime event-loop termination now preserves the requested exit code.
Release and dependency metadata `.cargo/audit.toml`, `.github/RELEASING.md`, `packages/api/package.json`, `packages/cli/Cargo.toml`, `packages/cli/package.json`, `pnpm-workspace.yaml`, `renovate.json`	Audit, release documentation, package versions, workspace overrides, and Renovate rules were updated.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

OlympusLedgerOrg/tauri#12: Modifies .cargo/audit.toml advisory management for different dependencies.
OlympusLedgerOrg/tauri#14: Modifies pnpm-workspace.yaml dependency overrides for different packages.

Suggested reviewers: legend-master, amrbashir, lucasfernog

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change as synchronizing the fork's dev branch with upstream on August 9, 2026.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch claude/sync-review-26rwlz

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-08-09T12:37:50Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/vitest@4.1.10
	cargo/napi@3.9.4 ⏵ 3.12.0
	cargo/glob@0.3.2 ⏵ 0.3.4
	cargo/napi-build@2.3.2 ⏵ 2.4.0
	cargo/napi-derive@3.5.7 ⏵ 3.6.2
	npm/@napi-rs/cli@3.8.2

View full report

OlympusLedgerOrg · 2026-08-09T12:45:18Z

audit-js and audit-rust are red here, but this predates the PR: the scheduled Audit workflow has been failing on dev at e13c347 (this PR's base, before any sync changes) every day since at least 2026-08-05 — same failures (rkyv RUSTSEC-2026-0235, js-yaml via @napi-rs/cli's bundled copy, nanoid). None of those crates/packages are touched by this sync's diff. Will re-run once dev's audit recovers; not fixing here since it's out of scope for a version-bump sync.

Generated by Claude Code

audit-js (2 high): - js-yaml: the existing override pinned exactly 4.3.0, but CVE-2026-59870 (quadratic CPU in !!omap resolution, GHSA-5p4m-2wfm-xmqj) is only fixed in >= 4.3.1. Widen the range to <4.3.1 and pin 4.3.1. Reached via packages/cli > @napi-rs/cli > js-yaml. - nanoid: no override existed. postcss 8.5.23 still resolves nanoid 3.3.16, which is vulnerable to GHSA-2v37-7h3g-55p8 (custom generators loop indefinitely when size is zero). Pin 3.3.17. Pinned exactly rather than '>=3.3.17' because 3.3.18 was published 2026-08-07 and is still inside the repo's minimumReleaseAge window (4320m). audit-rust (1 vulnerability): - rkyv 0.7.46, RUSTSEC-2026-0235 (out-of-bounds read via Rc/Arc archives). Patched only in >= 0.8.17; the 0.7 series is affected and unsupported upstream. rkyv is unreachable from the workspace -- `cargo tree -i rkyv --workspace --target all` resolves to nothing -- because it enters Cargo.lock solely as an optional, non-activated dependency of rust_decimal (rust_decimal > byte-unit > tauri-plugin-log > examples/api), and rust_decimal still declares `rkyv ^0.7.46` even at 1.42.1. cargo-audit scans Cargo.lock literally, so it flags a crate that is never compiled. Ignored with that rationale until rust_decimal moves the optional dep to rkyv 0.8. Verified locally: `pnpm audit` -> no known vulnerabilities; `cargo audit` -> exit 0, 9 allowed warnings; prettier --check clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

OlympusLedgerOrg · 2026-08-09T18:09:21Z

@coderabbitai review

Pushed 14f8b07 to clear the two red audit checks. Summary for review context:

js-yaml: the existing pnpm override pinned exactly 4.3.0, but CVE-2026-59870 (GHSA-5p4m-2wfm-xmqj) is only fixed in >= 4.3.1. Widened to js-yaml@>=4.0.0 <4.3.1: 4.3.1. Reached via packages/cli > @napi-rs/cli > js-yaml.
nanoid: no override existed; postcss@8.5.23 still resolves nanoid@3.3.16 (GHSA-2v37-7h3g-55p8). Added nanoid@<3.3.17: 3.3.17. Pinned exactly rather than >=3.3.17 because 3.3.18 was published 2026-08-07 and is still inside this repo's minimumReleaseAge window (4320m).
rkyv RUSTSEC-2026-0235: patched only in >= 0.8.17; the 0.7 series is affected and unsupported upstream. rkyv is never compiled here — cargo tree -i rkyv --workspace --target all resolves to nothing — because it enters Cargo.lock solely as an optional, non-activated dependency of rust_decimal (rust_decimal > byte-unit > tauri-plugin-log > examples/api), and rust_decimal still declares rkyv ^0.7.46 even at 1.42.1. cargo-audit scans Cargo.lock literally, so it flags a crate that is not in the build graph. Added to .cargo/audit.toml with that rationale rather than forcing an unusable upgrade.

Verified locally before pushing: pnpm audit → no known vulnerabilities; cargo audit → exit 0 (9 allowed warnings); prettier --check clean on both changed YAML files.

Generated by Claude Code

coderabbitai · 2026-08-09T18:09:34Z

@OlympusLedgerOrg I will review commit 14f8b07. I will verify the pnpm overrides, lockfile resolution, and the .cargo/audit.toml exception.

✏️ Learnings added

Learnt from: OlympusLedgerOrg
URL: https://github.com/OlympusLedgerOrg/tauri/pull/16

Timestamp: 2026-08-09T18:09:33.694Z
Learning: In this repository, `rkyv` from `rust_decimal > byte-unit > tauri-plugin-log > examples/api` can remain in `Cargo.lock` as an optional, non-activated dependency. It is not present in the workspace build graph under `cargo tree -i rkyv --workspace --target all`. `RUSTSEC-2026-0235` is therefore documented as an allowed warning in `.cargo/audit.toml` rather than resolved by an incompatible `rkyv` upgrade.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai

Actionable comments posted: 3

🧹 Nitpick comments (1)

.cargo/audit.toml (1)
14-21: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Limit this RUSTSEC-2026-0235 exception to the supported feature set.

cargo tree -i rkyv --workspace --target all only checks the default feature graph. If byte-unit/rust_decimal are built with the rkyv feature enabled, rkyv can become part of the dependency graph, so document that boundary or keep this ignored only while rkyv remains unreachable for supported builds.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.cargo/audit.toml around lines 14 - 21, Update the RUSTSEC-2026-0235 audit
exception documentation to state that it is valid only for supported builds
without the byte-unit/rust_decimal rkyv feature enabled. Verify the supported
feature graph, and narrow or remove the exception if enabling that feature makes
rkyv reachable; keep the existing dependency rationale accurate.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/RELEASING.md:
- Line 18: Update the release handbook sentence containing “@tauri-apps/cli” so
the plural subject “native Node.js modules” uses “which are published,” or
equivalent grammatically correct wording.

In `@crates/tauri-build/src/lib.rs`:
- Around line 210-219: Update target_dir_from_out_dir to distinguish the Cargo
build-directory ancestor from a package directory also named build, supporting
both documented stable and nightly OUT_DIR layouts and returning the actual
target directory. Add a regression test covering the nightly path
<target>/build/build/<hash>/out and verify resource and sidecar resolution uses
<target>.

In `@packages/cli/package.json`:
- Around line 44-47: Align the Vitest dependency with the project’s Node.js
support policy: either update the root and each CLI package engine declarations
from >= 10 to >= 20, or replace Vitest 4.1.10 with a Vitest 3-compatible version
if Node.js 10 support must remain. Ensure all affected CLI package engine fields
are consistent.

---

Nitpick comments:
In @.cargo/audit.toml:
- Around line 14-21: Update the RUSTSEC-2026-0235 audit exception documentation
to state that it is valid only for supported builds without the
byte-unit/rust_decimal rkyv feature enabled. Verify the supported feature graph,
and narrow or remove the exception if enabling that feature makes rkyv
reachable; keep the existing dependency rationale accurate.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6cc2dbad-79ad-491b-a9dc-0ebd2de72193

📥 Commits

Reviewing files that changed from the base of the PR and between e13c347 and 14f8b07.

⛔ Files ignored due to path filters (12)

Cargo.lock is excluded by !**/*.lock
crates/tests/acl/fixtures/snapshots/acl_tests__tests__basic-ping.snap is excluded by !**/*.snap
crates/tests/acl/fixtures/snapshots/acl_tests__tests__file-explorer-remote.snap is excluded by !**/*.snap
crates/tests/acl/fixtures/snapshots/acl_tests__tests__file-explorer.snap is excluded by !**/*.snap
crates/tests/acl/fixtures/snapshots/acl_tests__tests__multiwebview.snap is excluded by !**/*.snap
crates/tests/acl/fixtures/snapshots/acl_tests__tests__multiwindow.snap is excluded by !**/*.snap
crates/tests/acl/fixtures/snapshots/acl_tests__tests__scope-extended.snap is excluded by !**/*.snap
crates/tests/acl/fixtures/snapshots/acl_tests__tests__scope.snap is excluded by !**/*.snap
crates/tests/acl/fixtures/snapshots/linux/acl_tests__tests__platform-specific-permissions.snap is excluded by !**/*.snap
crates/tests/acl/fixtures/snapshots/macOS/acl_tests__tests__platform-specific-permissions.snap is excluded by !**/*.snap
crates/tests/acl/fixtures/snapshots/windows/acl_tests__tests__platform-specific-permissions.snap is excluded by !**/*.snap
pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (15)

.cargo/audit.toml
.changes/exit-with-code.md
.changes/fix-deterministic-config-serialization.md
.changes/fix-deterministic-embedded-assets-codegen.md
.changes/target-dir-nightly-out-dir.md
.github/RELEASING.md
crates/tauri-build/src/lib.rs
crates/tauri-codegen/src/embedded_assets.rs
crates/tauri-runtime-wry/src/lib.rs
crates/tauri-utils/src/config.rs
packages/api/package.json
packages/cli/Cargo.toml
packages/cli/package.json
pnpm-workspace.yaml
renovate.json

Legend-Master and others added 11 commits August 4, 2026 15:52

ci: remove renovate cli group name (tauri-apps#15811)

259cffb

* ci: remove renovate cli group name * bump napi-rs but auto cli packages * why prettier this time?

fix(runtime-wry): return the expected exit code from run_return() (ta…

0aeadb6

…uri-apps#15821) * fix(runtime-wry): return the expected exit code from run_return() Transfer the exit code from the window.app_handle().exit(1) call to the run_return() result instead of always returning 0.

chore(deps): update dependency rollup to v4.62.4 (tauri-apps#15796)

9967cdb

* chore(deps): update dependency rollup to v4.62.4 * bump nanoid for audit --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Tony <legendmastertony@gmail.com>

Fix doubled word in RELEASING.md (tauri-apps#15853)

2f11853

Merge remote-tracking branch 'upstream/dev' into claude/sync-review-2…

206f4c0

…6rwlz # Conflicts: # Cargo.lock # pnpm-lock.yaml # pnpm-workspace.yaml

chore: bump glob to 0.3.4 (missed by cargo update --workspace, needed…

0cfd10e

… for ACL snapshot tests to pass after upstream sync)

coderabbitai Bot reviewed Aug 9, 2026

View reviewed changes

Comment thread .github/RELEASING.md

Comment thread crates/tauri-build/src/lib.rs

Comment thread packages/cli/package.json

OlympusLedgerOrg marked this pull request as ready for review August 9, 2026 18:49

OlympusLedgerOrg merged commit d1b9940 into dev Aug 9, 2026
39 checks passed

Navigation Menu

Sync upstream/dev (2026-08-09) - #16

Sync upstream/dev (2026-08-09)#16
OlympusLedgerOrg merged 12 commits into
devfrom
claude/sync-review-26rwlz

OlympusLedgerOrg commented Aug 9, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 9, 2026 •

edited

Loading

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

socket-security Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

OlympusLedgerOrg commented Aug 9, 2026

Uh oh!

OlympusLedgerOrg commented Aug 9, 2026

Uh oh!

coderabbitai Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Conversation

OlympusLedgerOrg commented Aug 9, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why this sync is small

Commits

What's in the 9 upstream commits

Validation

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

socket-security Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

OlympusLedgerOrg commented Aug 9, 2026

Uh oh!

OlympusLedgerOrg commented Aug 9, 2026

Uh oh!

coderabbitai Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

OlympusLedgerOrg commented Aug 9, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 9, 2026 •

edited

Loading

socket-security Bot commented Aug 9, 2026 •

edited

Loading

coderabbitai Bot commented Aug 9, 2026 •

edited

Loading