Cargo Audit
Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
Loaded 1243 security advisories (from /home/runner/.cargo/advisory-db)
Updating crates.io index
Scanning Cargo.lock for vulnerabilities (1217 crate dependencies)
Crate: fxhash
Version: 0.2.1
Warning: unmaintained
Title: fxhash - no longer maintained
Date: 2025-09-05
ID: RUSTSEC-2025-0057
URL: https://rustsec.org/advisories/RUSTSEC-2025-0057
Crate: paste
Version: 1.0.15
Warning: unmaintained
Title: paste - no longer maintained
Date: 2024-10-07
ID: RUSTSEC-2024-0436
URL: https://rustsec.org/advisories/RUSTSEC-2024-0436
Crate: rustls-pemfile
Version: 2.2.0
Warning: unmaintained
Title: rustls-pemfile is unmaintained
Date: 2025-11-28
ID: RUSTSEC-2025-0134
URL: https://rustsec.org/advisories/RUSTSEC-2025-0134
Crate: rustybuzz
Version: 0.20.1
Warning: unmaintained
Title: `rustybuzz` is unmaintained
Date: 2026-07-11
ID: RUSTSEC-2026-0206
URL: https://rustsec.org/advisories/RUSTSEC-2026-0206
Crate: ttf-parser
Version: 0.25.1
Warning: unmaintained
Title: `ttf-parser` is unmaintained
Date: 2026-06-28
ID: RUSTSEC-2026-0192
URL: https://rustsec.org/advisories/RUSTSEC-2026-0192
warning: 5 allowed warnings found
[3.0.0-alpha.0]
Enhancements
-
65792f536Plugin and app build scripts now write the autogenerated command permissions toOUT_DIRinstead of the crate'spermissions/autogeneratedfolder, so they no longer need to be committed at the crate level. This applies to plugin crates (tauri-plugin) and the application manifest (tauri_build::AppManifest); inlined plugins (tauri_build::InlinedPlugin) already wrote them toOUT_DIR. For plugin crates, the human-readable permission documentation (reference.md) is still generated inpermissions/autogeneratedso it stays recoverable.Added
tauri_utils::acl::build::collect_permission_filesandtauri_utils::acl::build::define_permissions_from_filesto allow merging permission files from multiple directories into a single permission file list.
Performance Improvements
-
fb7bdd95bReduce the size of the resolved ACL embedded in the app by storing the autogenerated command permissions as acommandslist on the plugin/app manifest instead of two explicit permissions (allow-$commandanddeny-$command) per command. Theallow-$command/deny-$commandpermissions are now materialized on demand when resolving the ACL.The application manifest also gains implicit
allow-*anddeny-*permissions that allow or deny all of its commands through a single resolved entry, so capabilities no longer need to list every command individually.
What's Changed
Dependencies
- Upgraded to
tauri-utils@3.0.0-alpha.0
Cargo Publish
Updating crates.io index
Packaging tauri-plugin v3.0.0-alpha.0 (/home/runner/work/tauri/tauri/crates/tauri-plugin)
Updating crates.io index
Packaged 9 files, 71.3KiB (20.4KiB compressed)
Verifying tauri-plugin v3.0.0-alpha.0 (/home/runner/work/tauri/tauri/crates/tauri-plugin)
Compiling serde_json v1.0.151
Compiling uuid v1.26.0
Compiling cfb v0.14.0
Compiling infer v0.22.0
Compiling jsonptr v0.7.1
Compiling cargo_metadata v0.19.2
Compiling json-patch v4.2.0
Compiling schemars v1.2.2
Compiling tauri-utils v3.0.0-alpha.0
Compiling tauri-plugin v3.0.0-alpha.0 (/home/runner/work/tauri/tauri/target/package/tauri-plugin-3.0.0-alpha.0)
Finished `dev` profile [unoptimized + debuginfo] target(s) in 9.48s
Uploading tauri-plugin v3.0.0-alpha.0 (/home/runner/work/tauri/tauri/crates/tauri-plugin)
Uploaded tauri-plugin v3.0.0-alpha.0 to registry `crates-io`
note: waiting for tauri-plugin v3.0.0-alpha.0 to be available at registry `crates-io`
help: you may press ctrl-c to skip waiting; the crate should be available shortly
Published tauri-plugin v3.0.0-alpha.0 at registry `crates-io`