Sync root files with upstream dev - #7
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
💤 Files with no reviewable changes (2)
📝 WalkthroughWalkthroughThe changes update webview listener cleanup, Apple and Android runtime bindings, tray deprecation metadata, CLI and bundler code, CI workflows, dependencies, licenses, examples, and documentation. ChangesRuntime and repository maintenance
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. Ignoring alerts on:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/audit.yml (1)
40-43: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPin the audit tool installations.
tool: cargo-auditandnpm i -g --force corepackresolve versions outside repository lockfiles, allowing upstream changes to alter the security gate without a PR. Pin approved versions or use a repository-managed bootstrap.Also applies to: 54-54
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/audit.yml around lines 40 - 43, Pin the externally resolved audit tools in the workflow: update the cargo-audit installation step and the global corepack installation command to use explicitly approved versions, or replace them with repository-managed bootstrap tooling. Preserve the existing audit behavior while ensuring both installations are reproducible and cannot change due to upstream releases.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/lint-rust.yml:
- Line 58: Update the workflow containing the actions/checkout@v7 step to set
persist-credentials: false, and add a permissions declaration granting only
contents: read at the workflow or job level.
In `@crates/tauri/src/webview/webview_window.rs`:
- Around line 1282-1299: Fix the iOS doctest by changing the assignment in the
input accessory view builder block to use the declared `builder` variable
consistently instead of the undefined `window_builder` identifier.
---
Nitpick comments:
In @.github/workflows/audit.yml:
- Around line 40-43: Pin the externally resolved audit tools in the workflow:
update the cargo-audit installation step and the global corepack installation
command to use explicitly approved versions, or replace them with
repository-managed bootstrap tooling. Preserve the existing audit behavior while
ensuring both installations are reproducible and cannot change due to upstream
releases.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5cbcb83c-ca08-4207-ad24-f7ed2199c1e4
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (63)
.changes/change-pr-15677.md.changes/fix-js-listeners-leak-on-webview-close.md.changes/fix-objc-retain-leak.md.github/workflows/audit.yml.github/workflows/lint-rust.yml.gitignoreLICENSE-APACHE-2.0LICENSE-MITcrates/tauri-build/LICENSE-APACHE-2.0crates/tauri-build/LICENSE-MITcrates/tauri-bundler/Cargo.tomlcrates/tauri-bundler/License-Apache.mdcrates/tauri-bundler/License-MIT.mdcrates/tauri-bundler/src/bundle/macos/dmg/mod.rscrates/tauri-bundler/src/bundle/windows/msi/mod.rscrates/tauri-cli/LICENSE-APACHE-2.0crates/tauri-cli/LICENSE-MITcrates/tauri-cli/config.schema.jsoncrates/tauri-cli/src/acl/capability/new.rscrates/tauri-cli/src/acl/permission/new.rscrates/tauri-cli/src/dev/builtin_dev_server.rscrates/tauri-cli/src/helpers/flock.rscrates/tauri-cli/src/helpers/pbxproj.rscrates/tauri-cli/src/interface/rust/desktop.rscrates/tauri-codegen/LICENSE-APACHE-2.0crates/tauri-codegen/LICENSE-MITcrates/tauri-driver/LICENSE-APACHE-2.0crates/tauri-driver/LICENSE-MITcrates/tauri-driver/LICENSE_APACHE-2.0crates/tauri-driver/LICENSE_MITcrates/tauri-macros/LICENSE-APACHE-2.0crates/tauri-macros/LICENSE-MITcrates/tauri-runtime-wry/LICENSE-APACHE-2.0crates/tauri-runtime-wry/LICENSE-MITcrates/tauri-runtime-wry/src/lib.rscrates/tauri-runtime-wry/src/webview.rscrates/tauri-runtime-wry/src/window/mod.rscrates/tauri-runtime/LICENSE-APACHE-2.0crates/tauri-runtime/LICENSE-MITcrates/tauri-schema-generator/schemas/config.schema.jsoncrates/tauri-utils/Cargo.tomlcrates/tauri-utils/LICENSE-APACHE-2.0crates/tauri-utils/LICENSE-MITcrates/tauri-utils/src/config.rscrates/tauri/LICENSE-APACHE-2.0crates/tauri/LICENSE-MITcrates/tauri/src/app.rscrates/tauri/src/event/listener.rscrates/tauri/src/lib.rscrates/tauri/src/manager/mod.rscrates/tauri/src/plugin/mobile.rscrates/tauri/src/test/mock_runtime.rscrates/tauri/src/tray/mod.rscrates/tauri/src/webview/webview_window.rscrates/tests/restart/LICENSE-APACHE-2.0crates/tests/restart/LICENSE-MITcrates/tests/restart/LICENSE_APACHE-2.0crates/tests/restart/LICENSE_MITexamples/api/src-tauri/src/lib.rspackages/api/LICENSE-APACHE-2.0packages/api/LICENSE-MITpackages/cli/LICENSE-APACHE-2.0packages/cli/LICENSE-MIT
💤 Files with no reviewable changes (4)
- crates/tests/restart/LICENSE_APACHE-2.0
- crates/tauri-driver/LICENSE_MIT
- crates/tests/restart/LICENSE_MIT
- crates/tauri-driver/LICENSE_APACHE-2.0
|
@SocketSecurity ignore cargo/openssl@0.10.80 |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/audit.yml (1)
39-50: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick winAdd the OpenSSL advisory ignore to
.cargo/audit.tomlcargo auditstill runs without an OpenSSL suppression, and the existing.cargo/audit.tomldoesn't include one, so theopenssl 0.10.80advisory will keep failing this job until it's added.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/audit.yml around lines 39 - 50, Add an OpenSSL advisory ignore entry to the existing `.cargo/audit.toml` configuration, targeting the advisory affecting openssl 0.10.80 so the `rust audit` step running `cargo audit` no longer fails on this known issue.
🧹 Nitpick comments (1)
.github/workflows/audit.yml (1)
57-57: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueAd-hoc global npm install flagged by zizmor.
npm i -g --force corepack@0.35.0installs a package outside any lockfile. It's pinned, which mitigates supply-chain risk somewhat, but consider whether Node's bundled corepack (if the runner's Node version still ships it) orcorepack enablecould avoid the ad-hoc global install entirely.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/audit.yml at line 57, Replace the ad-hoc global install in the workflow step with the runner’s bundled Corepack by invoking `corepack enable` directly, if supported by the configured Node version; otherwise pin and install Corepack through a lockfile-backed project dependency rather than using `npm i -g --force`.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/audit.yml:
- Around line 39-50: Add an OpenSSL advisory ignore entry to the existing
`.cargo/audit.toml` configuration, targeting the advisory affecting openssl
0.10.80 so the `rust audit` step running `cargo audit` no longer fails on this
known issue.
---
Nitpick comments:
In @.github/workflows/audit.yml:
- Line 57: Replace the ad-hoc global install in the workflow step with the
runner’s bundled Corepack by invoking `corepack enable` directly, if supported
by the configured Node version; otherwise pin and install Corepack through a
lockfile-backed project dependency rather than using `npm i -g --force`.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d9bde70f-2cb1-4266-b0e8-4375f5d91949
📒 Files selected for processing (3)
.github/workflows/audit.yml.github/workflows/lint-rust.ymlcrates/tauri/src/webview/webview_window.rs
✅ Files skipped from review due to trivial changes (1)
- crates/tauri/src/webview/webview_window.rs
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/lint-rust.yml
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/audit.yml (1)
48-49: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick winAdd the requested OpenSSL ignore before gating on
cargo audit
.cargo/audit.tomldoes not include anopenssladvisory exemption, andCargo.lockstill pinsopenssl 0.10.80. Add the missingRUSTSECentry or this workflow can start failing as soon as the advisory is present in the database.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/audit.yml around lines 48 - 49, Add an OpenSSL RUSTSEC advisory exemption to .cargo/audit.toml for the pinned openssl 0.10.80 dependency, ensuring the ignore entry is present before the rust audit step runs.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/audit.yml:
- Around line 48-49: Add an OpenSSL RUSTSEC advisory exemption to
.cargo/audit.toml for the pinned openssl 0.10.80 dependency, ensuring the ignore
entry is present before the rust audit step runs.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: e647543f-da39-4c0b-8a42-47b57b55fae5
📒 Files selected for processing (1)
.github/workflows/audit.yml
|
@CodeRabbit report status for ci |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="OlympusLedgerOrg/tauri"
pr=7
echo "=== PR checks ==="
gh pr checks $pr --repo "$repo" || true
echo "=== PR status detail ==="
gh pr view $pr --repo "$repo" --json statusCheckRollup,mergeable,mergeStateStatus,title,state --jq '.'Length of output: 18406
No failing or pending checks. One note: ✅ Action performedReview finished.
|
1 participant
Summary
Split
Part 1 of 3 replacing #6.
Validation
Summary by CodeRabbit
menuOnLeftClick“no longer works since v2.2” and updated guidance to useshow_menu_on_left_click.