tauri-apps/tauri tauri-v2.12.0

tauri v2.12.0

on GitHub

Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1271 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (1091 crate dependencies)
Crate:     fxhash
Version:   0.2.1
Warning:   unmaintained
Title:     fxhash - no longer maintained
Date:      2025-09-05
ID:        RUSTSEC-2025-0057
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0057

Crate:     paste
Version:   1.0.15
Warning:   unmaintained
Title:     paste - no longer maintained
Date:      2024-10-07
ID:        RUSTSEC-2024-0436
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0436

Crate:     rustls-pemfile
Version:   2.2.0
Warning:   unmaintained
Title:     rustls-pemfile is unmaintained
Date:      2025-11-28
ID:        RUSTSEC-2025-0134
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0134

Crate:     rustybuzz
Version:   0.20.1
Warning:   unmaintained
Title:     `rustybuzz` is unmaintained
Date:      2026-07-11
ID:        RUSTSEC-2026-0206
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0206

Crate:     ttf-parser
Version:   0.25.1
Warning:   unmaintained
Title:     `ttf-parser` is unmaintained
Date:      2026-06-28
ID:        RUSTSEC-2026-0192
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0192

warning: 5 allowed warnings found

[2.12.0]

New Features

• 3f62c70d6 (#13848) Add WebviewBuilder::limit_navigations_to_app_bound_domains, WebviewWindowBuilder::limit_navigations_to_app_bound_domains, and limitNavigationsToAppBoundDomains to tauri.config.json.
• 7dbfc1fe5 (#14620) Added the app > appDirectoriesOverride config to override the directories returned by the app_*_dir path APIs, either with a single root directory or per directory. This lets apps keep all of their data, including the data of Tauri itself and of plugins that use these APIs, in a single place of their choosing, such as next to the executable for portable apps. The override can also be set at runtime through Context::config_mut.
• d8d02ba60 (#14767) Added the exit function to @tauri-apps/api/app, backed by the new plugin:app|exit command (core:app:allow-exit permission), to exit the app without requiring the @tauri-apps/plugin-process plugin.
• 460ec3544 (#14786) Add Webview::convert_file_src and WebviewWindow::convert_file_src, the Rust equivalent of the JavaScript convertFileSrc function. The returned URL uses the scheme the webview was configured with (useHttpsScheme), so it always matches what the webview can load.
• 21ec647cf (#15223) Add Builder::activate_ignoring_other_apps on macOS to control whether the app activates at launch when another app is already active.
• d203f74a2 (#15274) Added Image::from_app_icon_resource and Image::from_icon_resource on Windows for loading images from icon resources embedded in the executable (identified by an IconResource id or name), and the default default_window_icon from tauri::generate_context macro is now loaded using from_app_icon_resource. The resource id tauri-build embeds the application icon with is exposed as tauri_utils::platform::WINDOWS_APP_ICON_RESOURCE_ID.
• 29265557c (#15410) Added app > windows > noRedirectionBitmap config option to disable the window redirection bitmap on Windows.
• 29265557c (#15410) Added WindowBuilder/WebviewWindowBuilder::no_redirection_bitmap method to disable the window redirection bitmap on Windows.
• 382dd6ccc (#14865) Expose the wry permission handler API through Tauri.
  This includes support for permission types such as DisplayCapture, Midi, Sensors, MediaKeySystemAccess, LocalFonts, WindowManagement, PointerLock, AutomaticDownloads, FileSystemAccess, and Autoplay.
  Added PermissionResponse::{Allow, Deny, Default} for runtime permission decisions.
• 6edc2f4d4 (#14926) Added Window::set_fullscreen_on_monitor, WebviewWindow::set_fullscreen_on_monitor and the setFullscreenOnMonitor JavaScript API to make a window fullscreen on the monitor containing a given physical position, along with the core:window:allow-set-fullscreen-on-monitor permission.

Enhancements

• aebf38c84 (#15694) Migrate the Android Gradle scripts from the deprecated kotlinOptions DSL to compilerOptions, which is accepted by both Kotlin Gradle Plugin 1.9.x and 2.x. This lets projects move to Kotlin 2.x without hitting the hard error that 2.3+ raises on the old DSL.

  This increased the minimum supported Gradle version to 8.13, if your gradle is on an earlier version, delete src-tauri/gen/android/gradle/wrapper/gradle-wrapper.properties and re-run tauri android init to update it.

• d3108ff9a (#15578) State had Send and Sync trait bounds that were already implied, remove them from the struct definition.

• 4a5065653 (#14454) Added Regular and Clear Liquid Glass window effects, and the interactive window effects option (macOS 27.0+) that enables the glass' visual response to user interactions.

• 459fc315e (#15711) Fix different build and runtime debug assertion profiles on the tauri-utils crate can resulting in compilation errors.

Bug Fixes

• 0349b6fb8 (#16072) Fix the runtime ACL denying a command for every origin when any capability denied it: deny permissions are now correctly scoped to the capability's execution context (local/remote) instead of denying the command for every origin. Previously a capability that denied a command for a remote URL also denied it for the local app (and vice-versa), because the origin match result was discarded. The debug message reporting an explicit denial now also only references the capabilities that actually deny the requesting origin.

• d8d02ba60 (#14767) On Android, AppHandle::exit (and the process plugin exit command) now finishes the activity instead of exiting the process directly, so the app closes with the system transition instead of flashing a blank screen.

• e3e3474d3 On Android, Invoke.resolveObject and the other values serialized with the plugin JSON mapper now write JSObject and JSArray as JSON objects and arrays. They were serialized through their private fields, so a JSArray reached the frontend as { "values": [...] } and a JSObject as { "nameValuePairs": {...} }.

• 020919a1b (#15798) On Android, fixed requesting permission in a plugin fails after the first activity closed.

• cb2ecac53 (#15949) On Android, fixed a crash when an activity is destroyed while another one is already running — installing an APK over the running app is the common way to hit it. The plugin manager tried to move its activity result launchers to the surviving activity, and registerForActivityResult rejects that with IllegalStateException: LifecycleOwner ... is attempting to register while current state is RESUMED. Each activity now registers its own launchers when it is created.

• f9ed1a3fd (#15838) Fix malformed asset:// multi-range responses: the multipart body now ends with the closing boundary, Content-Type is only multipart/byteranges, and the status is 206 Partial Content.

• 127aa176b (#16050) Load asset:// files asynchronously instead of on the event loop thread, so a slow or unreachable path no longer freezes every window.

• 97f6666b9 (#16088) Bump tray-icon to 0.25 and muda to 0.20 to pick up the fix for left-click events being swallowed by the tray menu on macOS 27 (fix #16035).

• 1417768f9 (#15679) Remove the Channel used to send event to JavaScript side on dropping the menu

• 17717757b (#15617) Remove Rust-side event listeners bound to a window or webview when that target is destroyed, so listen/once handlers registered on a Window, Webview or WebviewWindow no longer leak after it is closed.

• 0aeadb6b2 (#15821) Transfer the exit code from the window.app_handle().exit(1) call to the run_return() result instead of always returning 0.

• 82c706e26 Stop queuing large channel payloads once the target webview is closed. They were kept in memory until the app exited, and a new webview reusing the same label could fetch them.

• 023fe7f59 (#15291) Fix capabilities added at runtime through add_capability (feature dynamic-acl) being merged into the command scopes of the build time ACL, which polluted unrelated plugin scopes and made their deserialization fail. Scope values are also no longer duplicated when a scoped permission allows more than one command.

• 4a0e1df18 (#15604) Remove a webview's JS event listeners from the backend Listeners map when that webview is destroyed. Previously the entries keyed by the source webview label lingered after the webview was dropped, so they could never be delivered and leaked until the app exited — forcing apps to manually unlisten() before closing a window.

• d727d6316 (#15630) Query monitor information (primary_monitor, monitor_from_point, available_monitors) on the main thread from the app-level runtime handle instead of touching the event loop's window target directly.

• a370f6533 (#15224) Avoid leaking Objective-C objects in WebviewMessage::WithWebview on Apple targets by replacing Retained::into_raw with scoped retained bindings and Retained::as_ptr pointer handoff.

• 406feea75 (#15800) Guard the handler lookup in the generated unlisten script. When the unlisten function ran before its listener registration eval reached the webview, the entry was still missing and reading its handlerId threw, which aborted _unlisten before it sent the backend plugin:event|unlisten and left the listener registered.

• 448d39ee2 (#15860) Fix menu related commands can panic if called with invalid input through invoke directly.

  • The internal do_menu_item! macro now returns Err(crate::Error::UnexpectedMenuKind) instead of unreachable!()
  • Added a new error type tauri::Error::UnexpectedMenuKind
  • menu:new with the Predefined kind now returns an error instead of panicking when the item option is missing
  • Converting an Image to a menu or tray icon now returns tauri::Error::InvalidIcon when the RGBA buffer does not match the image size, instead of panicking on Linux when the icon is rendered

• e517fa18e (#15450) Fix run_main_thread! macro used by things like MenuItem and some other APIs deadlock when called on main thread with MockRuntime

• 2087bcae2 (#15920) Fix path.normalize("") returning an empty string instead of ".", matching Node.js and the existing path.join("") behavior.

• 08acfb3fa (#15625) Fix webview don't get focus when Alt-Tab back to the window if unstable feature is enabled on Windows

• 5a882eccf (#15701) On Linux, fix resize cursor for undecorated Window not being set correctly when mouse is over a resize edge.

• 08acfb3fa (#15625) Fix WindowEvent::Focused events emitted when dragging the window on Windows

• f4feb2ba7 (#15950) On Windows, fixed Window::is_focused always returns false in multi-webview mode

Performance Improvements

• 26a876a9f (#16049) Skip redundant rgba buffer copies in icon conversions (muda::Icon/tray_icon::Icon), Image::from_bytes, and submenu icon construction.
• ba0828c76 (#15955) Skip serializing to JSON for Image::rgba

What's Changed

• 1fbadc877 (#15952) Internal refactors removing an Arc and a Mutex.
  Deprecate InvokeMessage::state and InvokeMessage::state_ref that should accidentally were made public.
• 2e6e33c85 (#16029) Moved to edition 2024
• ce3f13b91 (#15887) Lock unstable tauri crates to minor versions.
• 7cc68e74f (#15307) WindowEvent::Resumed and WindowEvent::Suspended are now only fired for the matching activity window instead of every window.
• 1cffb01da (#13221) Set MSRV to 1.90.

Security fixes

• 201437309 Bind channel data IPC queue entries to the webview they were created for and scope their ids per webview.
  Queued channel payloads and large invoke responses can no longer be read by other webviews, and entries are purged when the owning webview is closed.
  Fixes GHSA-w28w-mhc8-qvjv.

Dependencies

• Upgraded to tauri-utils@2.10.0

• Upgraded to tauri-build@2.7.0

• Upgraded to tauri-runtime@2.12.0

• Upgraded to tauri-runtime-wry@2.12.0

• Upgraded to tauri-macros@2.7.0

• e2e585ad1 (#15828) On Android, fix missing consumer-rules.pro file in the template.

  IMPORTANT: For plugin authors, update your build.gradle.kts file to remove the

      buildTypes {
          release {
              isMinifyEnabled = false
              proguardFiles(
                  getDefaultProguardFile("proguard-android-optimize.txt"),
                  "proguard-rules.pro"
              )
          }
      }

  section and rename your proguard-rules.pro to consumer-rules.pro to match the consumerProguardFiles("consumer-rules.pro") in the template.

• e2e585ad1 (#15828) On Android, updated the template to use Gradle v9.6.1 (com.android.tools.build:gradle v9.3.1) and Kotlin v2.2. Use tauri android init to apply the change.

• 2bb4fdbd0 (#15592) Updated cargo_toml crate to 1

• 872428fe9 (#15790) On macOS, updated objc2-* dependencies to 0.3.2

• 9e9a54dea (#15890) Update swift-rs to support builds using Xcode 27.

• 51433d740 (#15996) Updated windows to 0.62 and webview2-com to 0.39, this drops Windows 7 support, see microsoft/windows-rs#3808.

Breaking Changes

• 26cb3d665 (#15563) On Android, $VIDEO and video_dir() now resolve to the app-specific Movies directory instead of external cache storage.

  Migration: Files previously written to the old location (.../cache) will not be discovered at the new location (.../files/Movies). Migrate existing files or update path assumptions accordingly.

Updating crates.io index
   Packaging tauri v2.12.0 (/home/runner/work/tauri/tauri/crates/tauri)
warning: ignoring example `commands` as `../../examples/commands/main.rs` is not included in the published package
warning: ignoring example `drag` as `../../examples/drag/main.rs` is not included in the published package
warning: ignoring example `helloworld` as `../../examples/helloworld/main.rs` is not included in the published package
warning: ignoring example `isolation` as `../../examples/isolation/main.rs` is not included in the published package
warning: ignoring example `multiwebview` as `../../examples/multiwebview/main.rs` is not included in the published package
warning: ignoring example `multiwindow` as `../../examples/multiwindow/main.rs` is not included in the published package
warning: ignoring example `run-return` as `../../examples/run-return/main.rs` is not included in the published package
warning: ignoring example `splashscreen` as `../../examples/splashscreen/main.rs` is not included in the published package
warning: ignoring example `state` as `../../examples/state/main.rs` is not included in the published package
warning: ignoring example `streaming` as `../../examples/streaming/main.rs` is not included in the published package
    Updating crates.io index
    Packaged 142 files, 1.4MiB (318.0KiB compressed)
   Verifying tauri v2.12.0 (/home/runner/work/tauri/tauri/crates/tauri)
 Downloading crates ...
  Downloaded alloc-stdlib v0.3.0
  Downloaded alloc-no-stdlib v3.0.0
  Downloaded brotli-decompressor v6.0.0
  Downloaded libappindicator-sys v0.9.0
  Downloaded brotli v9.0.0
  Downloaded libloading v0.7.4
  Downloaded libappindicator v0.9.0
  Downloaded keyboard-types v0.8.3
  Downloaded muda v0.20.0
  Downloaded serialize-to-javascript-impl v0.1.2
  Downloaded serde_repr v0.1.19
  Downloaded serialize-to-javascript v0.1.2
  Downloaded signal-hook-registry v1.4.2
  Downloaded tauri-macros v2.7.0
  Downloaded tauri-runtime-wry v2.12.0
  Downloaded tray-icon v0.25.1
  Downloaded tokio-macros v2.5.0
  Downloaded tauri-build v2.7.0
   Compiling toml_datetime v0.6.8
   Compiling serde_spanned v0.6.8
   Compiling cfg-expr v0.15.8
   Compiling serde_core v1.0.228
   Compiling zerofrom v0.1.5
   Compiling toml_edit v0.22.24
   Compiling phf_shared v0.13.1
   Compiling phf_generator v0.13.1
   Compiling thiserror v1.0.69
   Compiling proc-macro-error-attr v1.0.4
   Compiling syn v1.0.109
   Compiling yoke v0.8.1
   Compiling serde v1.0.228
   Compiling proc-macro-error v1.0.4
   Compiling toml_edit v0.20.7
   Compiling futures-macro v0.3.31
   Compiling toml v0.8.20
   Compiling system-deps v6.2.2
   Compiling futures-util v0.3.31
   Compiling proc-macro-crate v2.0.0
   Compiling glib-sys v0.18.1
   Compiling gobject-sys v0.18.0
   Compiling gio-sys v0.18.1
   Compiling gdk-sys v0.18.2
   Compiling bitflags v2.13.0
   Compiling zerovec v0.11.5
   Compiling glib-macros v0.18.5
   Compiling futures-executor v0.3.31
   Compiling pango-sys v0.18.0
   Compiling cairo-sys-rs v0.18.2
   Compiling gdk-pixbuf-sys v0.18.0
   Compiling phf_macros v0.13.1
   Compiling atk-sys v0.18.2
   Compiling tinystr v0.8.2
   Compiling rustc_version v0.4.1
   Compiling phf_codegen v0.13.1
   Compiling icu_locale_core v2.1.1
   Compiling potential_utf v0.1.4
   Compiling zerotrie v0.2.3
   Compiling thiserror v2.0.12
   Compiling icu_collections v2.1.1
   Compiling icu_provider v2.1.1
   Compiling gtk-sys v0.18.2
   Compiling phf v0.13.1
   Compiling parking_lot_core v0.9.10
   Compiling string_cache_codegen v0.6.1
   Compiling alloc-no-stdlib v3.0.0
   Compiling alloc-stdlib v0.3.0
   Compiling parking_lot v0.12.3
   Compiling glib v0.18.5
   Compiling web_atoms v0.2.3
   Compiling icu_properties v2.1.2
   Compiling icu_normalizer v2.1.1
   Compiling idna_adapter v1.2.1
   Compiling string_cache v0.9.0
   Compiling serde_json v1.0.145
   Compiling brotli-decompressor v6.0.0
   Compiling getrandom v0.2.15
   Compiling toml_parser v1.0.9+spec-1.1.0
   Compiling toml_datetime v1.0.0+spec-1.1.0
   Compiling serde_spanned v1.0.4
   Compiling form_urlencoded v1.2.2
   Compiling toml v1.0.6+spec-1.1.0
   Compiling brotli v9.0.0
   Compiling uuid v1.11.0
   Compiling idna v1.1.0
   Compiling field-offset v0.3.6
   Compiling selectors v0.38.0
   Compiling toml_edit v0.19.15
   Compiling cssparser v0.37.0
   Compiling gio v0.18.4
   Compiling cairo-rs v0.18.5
   Compiling proc-macro-crate v1.3.1
   Compiling indexmap v1.9.3
   Compiling url v2.5.8
   Compiling markup5ever v0.39.0
   Compiling soup3-sys v0.5.0
   Compiling javascriptcore-rs-sys v1.1.1
   Compiling hashbrown v0.12.3
   Compiling schemars v0.8.22
   Compiling gtk v0.18.2
   Compiling html5ever v0.39.0
   Compiling gtk3-macros v0.18.2
   Compiling atk v0.18.2
   Compiling cfb v0.14.0
   Compiling jsonptr v0.7.1
   Compiling erased-serde v0.4.9
   Compiling time v0.3.51
   Compiling webkit2gtk-sys v2.0.2
   Compiling dom_query v0.28.0
   Compiling plist v1.10.0
   Compiling cargo_metadata v0.19.0
   Compiling serde-untagged v0.1.6
   Compiling infer v0.22.0
   Compiling json-patch v4.2.0
   Compiling crc32fast v1.5.0
   Compiling urlpattern v0.6.0
   Compiling serde_with v3.21.0
   Compiling gdkx11-sys v0.18.2
   Compiling flate2 v1.1.1
   Compiling gdk-pixbuf v0.18.5
   Compiling pango v0.18.3
   Compiling tauri-utils v2.10.0
   Compiling dpi v0.1.1
   Compiling gdk v0.18.2
   Compiling soup3 v0.5.0
   Compiling embed-resource v3.0.9
   Compiling javascriptcore-rs v1.1.2
   Compiling tauri-winres v0.3.6
   Compiling png v0.17.16
   Compiling cargo_toml v1.0.0
   Compiling dlopen2_derive v0.4.0
   Compiling ico v0.5.0
   Compiling sha2 v0.10.8
   Compiling wry v0.57.0
   Compiling dlopen2 v0.8.0
   Compiling tauri-build v2.7.0
   Compiling gdkx11 v0.18.2
   Compiling png v0.18.1
   Compiling gdkwayland-sys v0.18.2
   Compiling muda v0.20.0
   Compiling tauri-runtime-wry v2.12.0
   Compiling tauri v2.12.0 (/home/runner/work/tauri/tauri/target/package/tauri-2.12.0)
   Compiling tauri-codegen v2.7.0
   Compiling keyboard-types v0.8.3
   Compiling serialize-to-javascript-impl v0.1.2
   Compiling tauri-macros v2.7.0
   Compiling serialize-to-javascript v0.1.2
   Compiling tokio v1.45.1
   Compiling serde_repr v0.1.19
   Compiling mime v0.3.17
   Compiling webkit2gtk v2.0.2
   Compiling tao v0.37.0
   Compiling tauri-runtime v2.12.0
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 02s
   Uploading tauri v2.12.0 (/home/runner/work/tauri/tauri/crates/tauri)
    Uploaded tauri v2.12.0 to registry `crates-io`
note: waiting for tauri v2.12.0 to be available at registry `crates-io`
help: you may press ctrl-c to skip waiting; the crate should be available shortly
   Published tauri v2.12.0 at registry `crates-io`