Cargo Audit
Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
Loaded 1243 security advisories (from /home/runner/.cargo/advisory-db)
Updating crates.io index
Scanning Cargo.lock for vulnerabilities (1217 crate dependencies)
Crate: fxhash
Version: 0.2.1
Warning: unmaintained
Title: fxhash - no longer maintained
Date: 2025-09-05
ID: RUSTSEC-2025-0057
URL: https://rustsec.org/advisories/RUSTSEC-2025-0057
Crate: paste
Version: 1.0.15
Warning: unmaintained
Title: paste - no longer maintained
Date: 2024-10-07
ID: RUSTSEC-2024-0436
URL: https://rustsec.org/advisories/RUSTSEC-2024-0436
Crate: rustls-pemfile
Version: 2.2.0
Warning: unmaintained
Title: rustls-pemfile is unmaintained
Date: 2025-11-28
ID: RUSTSEC-2025-0134
URL: https://rustsec.org/advisories/RUSTSEC-2025-0134
Crate: rustybuzz
Version: 0.20.1
Warning: unmaintained
Title: `rustybuzz` is unmaintained
Date: 2026-07-11
ID: RUSTSEC-2026-0206
URL: https://rustsec.org/advisories/RUSTSEC-2026-0206
Crate: ttf-parser
Version: 0.25.1
Warning: unmaintained
Title: `ttf-parser` is unmaintained
Date: 2026-06-28
ID: RUSTSEC-2026-0192
URL: https://rustsec.org/advisories/RUSTSEC-2026-0192
warning: 5 allowed warnings found
[3.0.0-alpha.0]
New Features
1e5ba7b53(#15985) Added thetauri_runtime::dynamicmodule withDynRuntime, a type-erasedRuntimethat wraps any concrete runtime selected at build time throughDynRuntimeInitAttrs, along withDynWebview,DynWindowOpenerandDynWebviewAttributeswrappers that can be downcast to the runtime's types.
What's Changed
Dependencies
- Upgraded to
tauri-utils@3.0.0-alpha.0
Breaking Changes
-
1e5ba7b53(#15985)WebviewDispatch::open_devtools,close_devtoolsandis_devtools_openare now required regardless of thedevtoolsfeature, so the type-erased runtime can forward them. Runtimes should keep their implementation behind the feature and no-op without it. -
c8c75b1f7(#15787) The GTK types crossing the runtime boundary are now version-agnostic raw pointers, so a runtime can use a GTK version different from the one thetauricrate was built with:WindowDispatch::gtk_windowandWindowDispatch::default_vboxreturn*mut c_void(GtkApplicationWindow*/GtkBox*) instead ofgtk::ApplicationWindow/gtk::Box. Both are transfer full: the implementation hands out a strong reference (glib'sto_glib_full) and the caller releases it (from_glib_full).WindowBuilder::transient_fortakes the parent as*mut c_void(GtkWindow*), also transfer full: the implementation must release the reference, including when it does not support transient windows.RawWindow::gtk_windowandRawWindow::default_vboxare*mut c_voidas well, but transfer none: they are borrowed for the duration of the callback and must be wrapped withfrom_glib_none.tauri_runtime_wry::GtkWindowandtauri_runtime_wry::GtkBoxare newtypes over*mut c_void.
tauri-runtimeno longer depends on thegtkcrate.The new
tauri_runtime::gtkmodule carries the GTK version a runtime binds to: runtimes callgtk::declare_versionbefore creating windows sotauri, which picks its bindings at compile time, can detect a mismatch instead of reinterpreting a GTK object of the other version. -
1e5ba7b53(#15985) The custom scheme URL format (tauri://localhostorhttp://tauri.localhost) is now defined by the runtime instead of the platform:Runtime::custom_scheme_urlmoved toRuntimeHandle::custom_scheme_url(&self, scheme, https), and theconvertFileSrcJavaScript API takes the format from the runtime.tauri::test::MockRuntimeusestauri://localhoston every platform, so tests that sent IPC requests fromhttp://tauri.localhoston Windows and Android must usetauri://localhostinstead. -
1e5ba7b53(#15985) Added the requiredRuntimeHandle::webview_versionmethod, exposed asApp::webview_versionandAppHandle::webview_version. Thetauri::webview_versionfunction was removed since the version depends on the runtime in use. -
1e5ba7b53(#15985) Added the requiredWebviewDispatch::with_ios_webviewmethod on iOS, which gives access to the platform webview, plugin manager and view controller pointers through the newwebview::IosWebviewHandle, sotaurino longer downcasts to the wry webview. -
1e5ba7b53(#15985)RuntimeSpecificInitAttrswas renamed toRuntimeInitAttrsand now selects the runtime it belongs to:- The trait is generic over the user event type and has a
type Runtime: Runtime<T, RuntimeInitAttrs = Self>associated type, so the attributes alone identify the runtime. - The implementation for
()was removed, every runtime must define its own attributes type. - Runtime crates must implement
From<Self>fordynamic::DynRuntimeInitAttrsso their attributes can be passed to the type-erased builder. Runtime::WindowOpenerandwindow::WindowBuilderBasenow require'static, so they can be type-erased.
- The trait is generic over the user event type and has a
Cargo Publish
Updating crates.io index
Packaging tauri-runtime v3.0.0-alpha.0 (/home/runner/work/tauri/tauri/crates/tauri-runtime)
Updating crates.io index
Packaged 17 files, 258.4KiB (59.4KiB compressed)
Verifying tauri-runtime v3.0.0-alpha.0 (/home/runner/work/tauri/tauri/crates/tauri-runtime)
Downloading crates ...
Downloaded raw-window-handle v0.6.2
Downloaded dpi v0.1.2
Downloaded cookie v0.18.2
Compiling time-macros v0.2.32
Compiling cookie v0.18.2
Compiling tauri-runtime v3.0.0-alpha.0 (/home/runner/work/tauri/tauri/target/package/tauri-runtime-3.0.0-alpha.0)
Compiling dpi v0.1.2
Compiling raw-window-handle v0.6.2
Compiling time v0.3.55
Compiling plist v1.10.1
Compiling tauri-utils v3.0.0-alpha.0
Finished `dev` profile [unoptimized + debuginfo] target(s) in 8.19s
Uploading tauri-runtime v3.0.0-alpha.0 (/home/runner/work/tauri/tauri/crates/tauri-runtime)
Uploaded tauri-runtime v3.0.0-alpha.0 to registry `crates-io`
note: waiting for tauri-runtime v3.0.0-alpha.0 to be available at registry `crates-io`
help: you may press ctrl-c to skip waiting; the crate should be available shortly
Published tauri-runtime v3.0.0-alpha.0 at registry `crates-io`