Track Tauri GTK upgrade to remediate glib advisory

[nedtwigg]

Problem

Dependabot alert 1 tracks glib 0.18.5 (GHSA-wrw7-89jp-8q8g / RUSTSEC-2024-0429)
in standalone/src-tauri/Cargo.lock. The affected crate is a Linux-only
transitive dependency:

tauri 2.11.5 -> gtk 0.18.2 -> glib 0.18.5

cargo update -p glib --precise 0.20.0 cannot resolve while Tauri declares
gtk = "0.18"; this is not a lockfile-only update. PR #662 fixes the separate
serde_with alert and deliberately leaves this one open.

Current upstream state

Tauri v2.11.5 still declares GTK 0.18 for Linux:

• https://github.com/tauri-apps/tauri/blob/tauri-v2.11.5/crates/tauri/Cargo.toml#L99-L102

However, the earlier assumption that GTK3 bindings had no upgrade path is no
longer current. gtk3-rs 0.19.0 was released on 2026-09-08 and depends on the
gtk-rs-core 0.22 line, as recorded by its maintainer in the upstream Tauri
discussion. A Tauri upgrade from GTK 0.18 to 0.19 may therefore clear this
alert without waiting for Tauri 3, but it needs an upstream Tauri release and
compatibility validation.

Upstream tracking

• [bug] Tauri 2.1.1 & 1.8.1 is affected by glib-rs 0.15 security vulnerability tauri-apps/tauri#12048 — original advisory report;
  closed as Tauri cannot fix the GTK3 dependency alone.
• Reach Out to gtk-rs for Potential glib Upgrade tauri-apps/tauri#12564 — GTK3 binding maintenance
  and Tauri's GTK4/v3 direction; its latest comments record the 0.19.0 release.

Exit criteria

• Monitor Tauri releases for a v2 update that moves the Linux GTK dependency to
  a line resolving glib >= 0.20.
• When available, update the Tauri dependency, regenerate the Cargo disclosure,
  and verify the Linux standalone build.
• If Tauri does not adopt the GTK3 0.19 line, evaluate its supported GTK4/v3
  migration path separately rather than forcing glib in Dormouse's lockfile.

[dormouse-bot]

gtk3-rs 0.19.0 does clear the advisory at the crate level — it requires glib ^0.22 — but a Tauri release is not the only gate. The GTK3 0.18 line reaches standalone/src-tauri/Cargo.lock through ten crates, and every one still requires ^0.18 today, including releases published after 0.19.0 landed on 2026-09-08.

Crate	Latest release	Requires
tauri	2.11.5 (2026-07-01)	gtk ^0.18
wry	0.57.0 (2026-09-08)	gtk ^0.18, webkit2gtk =2.0.2
tao	0.37.0 (2026-08-21)	gtk ^0.18
muda	0.20.0 (2026-09-11)	gtk ^0.18
webkit2gtk	2.0.2 (2025-12-16)	glib ^0.18.0, gtk ^0.18.0
javascriptcore-rs	1.1.2 (2023-10-26)	glib ^0.18.0

The binding layer, not Tauri, is the bottleneck. webkit2gtk-rs's default crate branch was pushed today and still declares glib = "^0.18.0" and gtk = "^0.18.0", so no unreleased bump is waiting, and wry 0.57.0 pins that crate at an exact =2.0.2. javascriptcore-rs has not published since 2023. A webkit2gtk release requiring glib >= 0.20 is therefore a tighter signal to monitor than Tauri releases — Tauri cannot move its GTK3 line before that one does.

There is also a second exit path the issue does not list. tauri 3.0.0-alpha.0 and 3.0.0-alpha.1 shipped on 2026-09-13 and 2026-09-15, and they declare both gtk ^0.18 and gtk4 ^0.11.4 as optional dependencies. A GTK4 build would drop the GTK3 cluster from the graph without gtk3-rs ever moving, which makes the last exit criterion ("evaluate its supported GTK4/v3 migration path") the path more likely to resolve first. It is not complete below Tauri yet: wry 0.57.0 and tao 0.37.0 carry no GTK4 or webkit6 dependency, only the feature-gated GTK3 one.

One project-level note, since this is an open medium advisory against a released artifact (release.yml builds standalone-linux-x64 from this lockfile): #662 observed that docs/specs/security-supply-chain.md -> "Cooldown and alerts" has FAIL IF rules for the cooldown configuration and for alerts being enabled, but nothing covering an alert that stays open. This issue is the tracking record, and whether the accepted-for-now state also belongs in the published disclosure — docs/specs/security.md -> "Known gaps" is where a reader would look — is a call worth making explicitly rather than by omission.