Repository navigation
Track Tauri GTK upgrade to remediate glib advisory #663
Description
Problem
Dependabot alert 1 tracks glib 0.18.5 (GHSA-wrw7-89jp-8q8g / RUSTSEC-2024-0429)
in standalone/src-tauri/Cargo.lock. The affected crate is a Linux-only
transitive dependency:
tauri 2.11.5 -> gtk 0.18.2 -> glib 0.18.5
cargo update -p glib --precise 0.20.0 cannot resolve while Tauri declares
gtk = "0.18"; this is not a lockfile-only update. PR #662 fixes the separate
serde_with alert and deliberately leaves this one open.
Current upstream state
Tauri v2.11.5 still declares GTK 0.18 for Linux:
However, the earlier assumption that GTK3 bindings had no upgrade path is no
longer current. gtk3-rs 0.19.0 was released on 2026-09-08 and depends on the
gtk-rs-core 0.22 line, as recorded by its maintainer in the upstream Tauri
discussion. A Tauri upgrade from GTK 0.18 to 0.19 may therefore clear this
alert without waiting for Tauri 3, but it needs an upstream Tauri release and
compatibility validation.
Upstream tracking
- [bug] Tauri 2.1.1 & 1.8.1 is affected by glib-rs 0.15 security vulnerability tauri-apps/tauri#12048 — original advisory report;
closed as Tauri cannot fix the GTK3 dependency alone. - Reach Out to
gtk-rsfor PotentialglibUpgrade tauri-apps/tauri#12564 — GTK3 binding maintenance
and Tauri's GTK4/v3 direction; its latest comments record the 0.19.0 release.
Exit criteria
- Monitor Tauri releases for a v2 update that moves the Linux GTK dependency to
a line resolvingglib >= 0.20. - When available, update the Tauri dependency, regenerate the Cargo disclosure,
and verify the Linux standalone build. - If Tauri does not adopt the GTK3 0.19 line, evaluate its supported GTK4/v3
migration path separately rather than forcingglibin Dormouse's lockfile.
Update 2026-10-30
- Version: Dormouse is now on tauri 2.12.5. It still pulls in the Linux-only GTK3 0.18 group (glib 0.18.5) through tauri-runtime-wry, wry 0.57.0, tao 0.37.2 and muda 0.20.0. Every newest release still requires
gtk ^0.18, including tauri 3.0.0-alpha.5. - What to watch:
tauri-apps/webkit2gtk-rs#166(glib 0.22 / gtk 0.19). wry pinswebkit2gtk =2.0.2exactly, so nothing above it can move until that PR is released. After that cometauri-apps/tao#1332,tauri-apps/muda#403,tauri-apps/tray-icon#362, and then tauri itself. - Reachability: we checked the registry sources of every crate in this group and found no call to
array_iter_strorVariantStrIter, the unsound API. Dormouse's own Rust code makes no glib or gtk calls. So the advisory is not reachable, anddocs/specs/security.mdgets no Known-gaps entry for it. - Once upstream lands: do a Linux standalone build check, regenerate the Cargo disclosure, and repeat the reachability check on any newly added crate that uses glib.
Activity
dormouse-bot commentedon Sep 15, 2026
gtk3-rs0.19.0 does clear the advisory at the crate level — it requiresglib ^0.22— but a Tauri release is not the only gate. The GTK3 0.18 line reachesstandalone/src-tauri/Cargo.lockthrough ten crates, and every one still requires^0.18today, including releases published after 0.19.0 landed on 2026-09-08.taurigtk ^0.18wrygtk ^0.18,webkit2gtk =2.0.2taogtk ^0.18mudagtk ^0.18webkit2gtkglib ^0.18.0,gtk ^0.18.0javascriptcore-rsglib ^0.18.0The binding layer, not Tauri, is the bottleneck.
webkit2gtk-rs's defaultcratebranch was pushed today and still declaresglib = "^0.18.0"andgtk = "^0.18.0", so no unreleased bump is waiting, andwry 0.57.0pins that crate at an exact=2.0.2.javascriptcore-rshas not published since 2023. Awebkit2gtkrelease requiringglib >= 0.20is therefore a tighter signal to monitor than Tauri releases — Tauri cannot move its GTK3 line before that one does.There is also a second exit path the issue does not list.
tauri 3.0.0-alpha.0and3.0.0-alpha.1shipped on 2026-09-13 and 2026-09-15, and they declare bothgtk ^0.18andgtk4 ^0.11.4as optional dependencies. A GTK4 build would drop the GTK3 cluster from the graph without gtk3-rs ever moving, which makes the last exit criterion ("evaluate its supported GTK4/v3 migration path") the path more likely to resolve first. It is not complete below Tauri yet:wry 0.57.0andtao 0.37.0carry no GTK4 or webkit6 dependency, only the feature-gated GTK3 one.One project-level note, since this is an open medium advisory against a released artifact (
release.ymlbuildsstandalone-linux-x64from this lockfile): #662 observed thatdocs/specs/security-supply-chain.md-> "Cooldown and alerts" hasFAIL IFrules for the cooldown configuration and for alerts being enabled, but nothing covering an alert that stays open. This issue is the tracking record, and whether the accepted-for-now state also belongs in the published disclosure —docs/specs/security.md-> "Known gaps" is where a reader would look — is a call worth making explicitly rather than by omission.