This repository was archived by the owner on Apr 6, 2026. It is now read-only.
chore(deps): update rust crate tauri to v2.0.0-beta.20 [security] - #6
Open
renovate[bot] wants to merge 1 commit into
Open
chore(deps): update rust crate tauri to v2.0.0-beta.20 [security]#6renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/crate-tauri-vulnerability
branch
from
August 12, 2025 23:52
11b3af2 to
64915eb
Compare
renovate
Bot
force-pushed
the
renovate/crate-tauri-vulnerability
branch
from
February 3, 2026 07:35
64915eb to
bccbc00
Compare
renovate
Bot
force-pushed
the
renovate/crate-tauri-vulnerability
branch
from
February 13, 2026 08:01
bccbc00 to
fb73c3d
Compare
renovate
Bot
force-pushed
the
renovate/crate-tauri-vulnerability
branch
from
March 1, 2026 13:01
fb73c3d to
ba97ff3
Compare
renovate
Bot
force-pushed
the
renovate/crate-tauri-vulnerability
branch
from
March 14, 2026 13:29
ba97ff3 to
bd3d62d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.0.0-beta.14→2.0.0-beta.20GitHub Vulnerability Alerts
CVE-2024-35222
Impact
Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the
dangerousRemoteDomainIpcAccessin v1 and in thecapabilitiesin v2.This bypasses the origin check and allows iFrames to access the IPC endpoints exposed to the parent window.
For this to be exploitable, an attacker must have script execution (e.g. XSS) in a script-enabled iFrame of a Tauri application.
Patches
The patches include changes to wry and the behaviour of Tauri applications using iFrames. Previously, we injected the Tauri IPC initialization script into iFrames on MacOS, which was unintended. This is now also disabled to be consistent with all other supported operating systems.
This means that the Tauri invoke functionality is no longer accessible from iFrames, except on Windows when the origin of the Tauri window and the origin of the iFrame are the same.
We have also added a new protection mechanism to the IPC layer to protect against iFrames directly using the WebView IPC functionality (e.g. via
window.ipc.postMessage).This introduces an invoke key (
__TAURI_INVOKE_KEY__) which is used to prevent frames that have not been initialized by the Tauri core from sending messages to the Tauri IPC.This key is not used to protect against compromised Tauri windows or WebViews and is only intended to block IPC access from sub-frames.
Unauthorized messages to the Tauri IPC from an iFrame or other non-initialized context will log a warning and the potentially malicious IPC call will be ignored.
Workarounds
These workarounds should only be considered if you are unable to upgrade to the patched Tauri version in time.
As a workaround for v1 Tauri applications, we recommend using a dedicated window for untrusted origins instead of iFrames, or disabling script execution within the iFrame.
For v2 Tauri applications targeting Linux, it is possible to use either a dedicated window or multiple WebViews in the main window to simulate iFrame behavior.
On other platforms, it is only possible to use dedicated windows or disable script execution inside the iFrame, as described for v1.
References
If you have any questions or comments about this advisory:
Open an issue in tauri or
Email us at security@tauri.app
The original submissions from the reporter:
Release Notes
tauri-apps/tauri (tauri)
v2.0.0-beta.20: tauri v2.0.0-beta.20Compare Source
Updating crates.io index
Cargo Audit
[2.0.0-beta.20]
New Features
ae6b13dfc(#9789) Addapp-region: dragto HTML elements withdata-tauri-drag-regionon Windows, only WebView2 123+, which should fix dragging using touch.ec0e092ec(#9770) AddApp/AppHandle/Window/Webview/WebviewWindow::monitor_from_point(x, y)getter to get the monitor from a given point.Enhancements
5d20530c9(#9842) AddedAppHandle::set_activation_policyfor macOS.Bug Fixes
0b690f242(#9845) Exporttauri::UriSchemeResponder.Security fixes
d950ac123Only process IPC commands from the main frame.Dependencies
tauri-utils@2.0.0-beta.16tauri-runtime-wry@2.0.0-beta.17tauri-runtime@2.0.0-beta.17tauri-macros@2.0.0-beta.16tauri-build@2.0.0-beta.16Cargo Publish
v2.0.0-beta.19: tauri-build v2.0.0-beta.19Compare Source
Updating git repository
https://github.com/chippers/schemars.gitUpdating crates.io index
Locking 498 packages to latest compatible versions
Adding addr2line v0.22.0 (latest: v0.23.0)
Adding base64 v0.21.7 (latest: v0.22.1)
Adding bit-set v0.5.3 (latest: v0.6.0)
Adding bit-vec v0.6.3 (latest: v0.7.0)
Adding bitflags v1.3.2 (latest: v2.6.0)
Adding brotli v3.5.0 (latest: v6.0.0)
Adding brotli-decompressor v2.5.1 (latest: v4.0.1)
Adding cairo-rs v0.18.5 (latest: v0.20.0)
Adding cairo-sys-rs v0.18.2 (latest: v0.20.0)
Adding cargo_toml v0.17.2 (latest: v0.20.3)
Adding cfb v0.7.3 (latest: v0.10.0)
Adding convert_case v0.4.0 (latest: v0.6.0)
Adding cssparser v0.27.2 (latest: v0.34.0)
Adding encode_unicode v0.3.6 (latest: v1.0.0)
Adding env_logger v0.8.4 (latest: v0.11.3)
Adding foreign-types v0.3.2 (latest: v0.5.0)
Adding foreign-types-shared v0.1.1 (latest: v0.3.1)
Adding gdk-pixbuf v0.18.5 (latest: v0.20.0)
Adding gdk-pixbuf-sys v0.18.0 (latest: v0.20.0)
Adding generator v0.7.5 (latest: v0.8.1)
Adding generic-array v0.14.7 (latest: v1.1.0)
Adding getrandom v0.1.16 (latest: v0.2.15)
Adding gimli v0.29.0 (latest: v0.30.0)
Adding gio v0.18.4 (latest: v0.20.0)
Adding gio-sys v0.18.1 (latest: v0.20.0)
Adding glib v0.18.5 (latest: v0.20.0)
Adding glib-macros v0.18.5 (latest: v0.20.0)
Adding glib-sys v0.18.1 (latest: v0.20.0)
Adding gobject-sys v0.18.0 (latest: v0.20.0)
Adding hashbrown v0.12.3 (latest: v0.14.5)
Adding heck v0.4.1 (latest: v0.5.0)
Adding hermit-abi v0.3.9 (latest: v0.4.0)
Adding html5ever v0.26.0 (latest: v0.27.0)
Adding idna v0.5.0 (latest: v1.0.2)
Adding image v0.24.9 (latest: v0.25.1)
Adding indexmap v1.9.3 (latest: v2.2.6)
Adding infer v0.15.0 (latest: v0.16.0)
Adding itoa v0.4.8 (latest: v1.0.11)
Adding jni-sys v0.3.0 (latest: v0.4.0)
Adding json-patch v1.4.0 (latest: v2.0.0)
Adding libloading v0.7.4 (latest: v0.8.4)
Adding linux-raw-sys v0.4.14 (latest: v0.6.4)
Adding loom v0.5.6 (latest: v0.7.2)
Adding malloc_buf v0.0.6 (latest: v1.0.0)
Adding markup5ever v0.11.0 (latest: v0.12.1)
Adding matchers v0.1.0 (latest: v0.2.0)
Adding mio v0.8.11 (latest: v1.0.0)
Adding ndk v0.7.0 (latest: v0.9.0)
Adding ndk-sys v0.4.1+23.1.7779620 (latest: v0.6.0+11769913)
Adding nu-ansi-term v0.46.0 (latest: v0.50.0)
Adding num_enum v0.5.11 (latest: v0.7.2)
Adding num_enum_derive v0.5.11 (latest: v0.7.2)
Adding pango v0.18.3 (latest: v0.20.0)
Adding pango-sys v0.18.0 (latest: v0.20.0)
Adding phf v0.8.0 (latest: v0.11.2)
Adding phf v0.10.1 (latest: v0.11.2)
Adding phf_codegen v0.8.0 (latest: v0.11.2)
Adding phf_codegen v0.10.0 (latest: v0.11.2)
Adding phf_generator v0.8.0 (latest: v0.11.2)
Adding phf_generator v0.10.0 (latest: v0.11.2)
Adding phf_macros v0.8.0 (latest: v0.11.2)
Adding phf_shared v0.8.0 (latest: v0.11.2)
Adding phf_shared v0.10.0 (latest: v0.11.2)
Adding proc-macro-crate v1.3.1 (latest: v3.1.0)
Adding proc-macro-crate v2.0.2 (latest: v3.1.0)
Adding quick-error v1.2.3 (latest: v2.0.1)
Adding quick-xml v0.32.0 (latest: v0.36.0)
Adding rand v0.7.3 (latest: v0.8.5)
Adding rand_chacha v0.2.2 (latest: v0.3.1)
Adding rand_core v0.5.1 (latest: v0.6.4)
Adding rand_hc v0.2.0 (latest: v0.3.2)
Adding rand_pcg v0.2.1 (latest: v0.3.1)
Adding raw-window-handle v0.5.2 (latest: v0.6.2)
Adding regex-automata v0.1.10 (latest: v0.4.7)
Adding regex-syntax v0.6.29 (latest: v0.8.4)
Adding rustc-hash v1.1.0 (latest: v2.0.0)
Adding selectors v0.22.0 (latest: v0.25.0)
Adding servo_arc v0.1.1 (latest: v0.3.0)
Adding siphasher v0.3.11 (latest: v1.0.1)
Adding soup3 v0.5.0 (latest: v0.7.0)
Adding soup3-sys v0.5.0 (latest: v0.7.0)
Adding syn v1.0.109 (latest: v2.0.71)
Adding system-deps v6.2.2 (latest: v7.0.1)
Adding toml v0.7.8 (latest: v0.8.14)
Adding toml v0.8.2 (latest: v0.8.14)
Adding toml_datetime v0.6.3 (latest: v0.6.6)
Adding toml_edit v0.19.15 (latest: v0.22.15)
Adding toml_edit v0.20.2 (latest: v0.22.15)
Adding wasi v0.9.0+wasi-snapshot-preview1 (latest: v0.13.1+wasi-0.2.0)
Adding wasi v0.11.0+wasi-snapshot-preview1 (latest: v0.13.1+wasi-0.2.0)
Adding windows v0.48.0 (latest: v0.58.0)
Adding windows v0.57.0 (latest: v0.58.0)
Adding windows-core v0.52.0 (latest: v0.58.0)
Adding windows-core v0.57.0 (latest: v0.58.0)
Adding windows-implement v0.57.0 (latest: v0.58.0)
Adding windows-interface v0.57.0 (latest: v0.58.0)
Adding windows-result v0.1.2 (latest: v0.2.0)
Adding windows-sys v0.45.0 (latest: v0.52.0)
Adding windows-sys v0.48.0 (latest: v0.52.0)
Adding windows-targets v0.42.2 (latest: v0.52.6)
Adding windows-targets v0.48.5 (latest: v0.52.6)
Adding windows_aarch64_gnullvm v0.42.2 (latest: v0.52.6)
Adding windows_aarch64_gnullvm v0.48.5 (latest: v0.52.6)
Adding windows_aarch64_msvc v0.42.2 (latest: v0.52.6)
Adding windows_aarch64_msvc v0.48.5 (latest: v0.52.6)
Adding windows_i686_gnu v0.42.2 (latest: v0.52.6)
Adding windows_i686_gnu v0.48.5 (latest: v0.52.6)
Adding windows_i686_msvc v0.42.2 (latest: v0.52.6)
Adding windows_i686_msvc v0.48.5 (latest: v0.52.6)
Adding windows_x86_64_gnu v0.42.2 (latest: v0.52.6)
Adding windows_x86_64_gnu v0.48.5 (latest: v0.52.6)
Adding windows_x86_64_gnullvm v0.42.2 (latest: v0.52.6)
Adding windows_x86_64_gnullvm v0.48.5 (latest: v0.52.6)
Adding windows_x86_64_msvc v0.42.2 (latest: v0.52.6)
Adding windows_x86_64_msvc v0.48.5 (latest: v0.52.6)
Adding winnow v0.5.40 (latest: v0.6.13)
Cargo Audit
[2.0.0-beta.19]
Bug Fixes
69dcfdfe0(#10267 by @lucasfernog) Fix build script rerun-if-changed instruction if Info.plist do not exist next to tauri.conf.json.Dependencies
tauri-codegen@2.0.0-beta.19tauri-utils@2.0.0-beta.19Cargo Publish
v2.0.0-beta.18: tauri-build v2.0.0-beta.18Compare Source
Cargo Audit
[2.0.0-beta.18]
Enhancements
35110dba2(#10106) Fix delete app data button gone on higher scaling (>= 1.5)Dependencies
tauri-utils@2.0.0-beta.18tauri-codegen@2.0.0-beta.18f955f7b49(#9929) Switch fromdirs_nexttodirsasdirs_nextis now unmaintained whiledirsisCargo Publish
v2.0.0-beta.17: tauri-build v2.0.0-beta.17Compare Source
Updating crates.io index
Cargo Audit
[2.0.0-beta.17]
Enhancements
adac2185a(#9898) Check for Android version code before building the package in release mode.Bug Fixes
19b696b61(#9710) Avoid copying resources if the target path is the same as source.What's Changed
9ac930380(#9850) Emitcargo:rustc-check-cfginstruction so Cargo validates custom cfg attributes on Rust 1.80 (or nightly-2024-05-05).Dependencies
tauri-utils@2.0.0-beta.17tauri-codegen@2.0.0-beta.17Breaking Changes
1df5cdeb0(#9858) Usetauri.conf.json > identifierto set thePackageNamein Android andBundleIdin iOS.aaecb6a72(#9890) Renameddevfunction tois_devCargo Publish
v2.0.0-beta.16: tauri-build v2.0.0-beta.16Compare Source
Updating crates.io index
Cargo Audit
[2.0.0-beta.16]
Dependencies
tauri-utils@2.0.0-beta.16tauri-codegen@2.0.0-beta.16Cargo Publish
v2.0.0-beta.15: tauri-build v2.0.0-beta.15Compare Source
Updating crates.io index
Cargo Audit
[2.0.0-beta.15]
Dependencies
tauri-utils@2.0.0-beta.15tauri-codegen@2.0.0-beta.15Cargo Publish
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.