Update Feat/cef with upstream

.cargo/audit.toml

@@ -8,4 +8,17 @@ ignore = [
   "RUSTSEC-2024-0370",
   # time crate can't be updated in the repo because of MSRV, users are unaffected
   "RUSTSEC-2026-0009",
+  # rand unsoundness, fixed when we remove kuchikiki from deps in v3, currently
+  # remains for semver reasons but is not built in default configuration
+  "RUSTSEC-2026-0097",
+  # glib 0.18.5 unsoundness, fixed by updating to gtk4
+  "RUSTSEC-2024-0429",
+  # rustls, fixed when updating to apple-codesign 0.28.0
+  "RUSTSEC-2026-0049",
+  # rustls, fixed when updating to apple-codesign 0.28.0
+  "RUSTSEC-2026-0098",
+  # rustls, fixed when updating to apple-codesign 0.28.0
+  "RUSTSEC-2026-0099",
+  # rustls, fixed when updating to apple-codesign 0.28.0
+  "RUSTSEC-2026-0104",
 ]

.changes/acl-command-permissions.md

@@ -0,0 +1,12 @@
+---
+tauri: patch:perf
+tauri-utils: patch:perf
+tauri-build: patch:perf
+tauri-plugin: patch:perf
+tauri-macros: patch:perf
+tauri-codegen: patch:perf
+---
+
+Reduce the size of the resolved ACL embedded in the app by storing the autogenerated command permissions as a `commands` list on the plugin/app manifest instead of two explicit permissions (`allow-$command` and `deny-$command`) per command. The `allow-$command`/`deny-$command` permissions are now materialized on demand when resolving the ACL.
+
+The application manifest also gains implicit `allow-*` and `deny-*` permissions that allow or deny **all** of its commands through a single resolved entry, so capabilities no longer need to list every command individually.

.changes/acl-identifier-error-context.md

@@ -0,0 +1,9 @@
+---
+"tauri-utils": "patch:enhance"
+---
+
+Improve diagnostics for invalid plugin and permission identifiers.
+
+The `Identifier` deserializer now wraps the inner error with the offending identifier string so the message reads `invalid plugin or permission identifier '<value>': ...`, surfacing the bad entry without requiring a grep through the file.
+
+The previous parse failure (`failed to parse JSON: identifiers can only include lowercase ASCII, hyphens which are not leading or trailing, and a single colon if using a prefix at line 16 column 23`) now reads `failed to parse JSON: invalid plugin or permission identifier 'sqlite_proxy:allow-foo': identifiers can only include lowercase ASCII, hyphens which are not leading or trailing, and a single colon if using a prefix at line 16 column 23`.

.changes/acl-number-int-preserved-on-serdejson-roundtrip.md

@@ -0,0 +1,7 @@
+---
+"tauri-utils": "patch:bug"
+---
+
+Fix `Number::Int` being silently coerced to `Number::Float` on `serde_json` round-trip.
+
+`From<serde_json::Value> for Value` was checking `as_f64()` first, which succeeds for every integer that fits in an f64, so integer JSON numbers were always deserialized as `Number::Float`. The check order is now `as_i64()` → `as_u64()` (cast to `i64`, wrapping for values above `i64::MAX`) → `as_f64()`, matching serde_json's own visitor convention.

.changes/load-tauri-protocol-async.md

@@ -0,0 +1,5 @@
+---
+tauri: patch:perf
+---
+
+Load `tauri://` custom protocol handlers asynchronously to speed up load time

.changes/mobile-run-command-deadlock.md

@@ -0,0 +1,5 @@
+---
+"tauri": patch:bug
+---
+
+Adjust mutex locking in `send_channel_data_handler`, `handle_android_plugin_response`, `send_channel_data` to avoid deadlocks

.changes/nsis-config-path-context.md

@@ -0,0 +1,5 @@
+---
+"tauri-bundler": "patch:enhance"
+---
+
+Improve NSIS configuration path errors so missing installer icons and images include the related config key and path.

.changes/nsis-stock-plugins-embed-signed.md

@@ -0,0 +1,5 @@
+---
+"tauri-bundler": "patch:bug"
+---
+
+Fix NSIS stock plugins (`NSISdl.dll`, `StartMenu.dll`, `System.dll`, `nsDialogs.dll`) being embedded in the final installer as unsigned despite the signing step succeeding. The signed local copies under `<output>/Plugins/x86-unicode/` were not on makensis' plugin search path, so makensis fell back to the unsigned DLLs from the NSIS toolset directory. The fix adds `!addplugindir` for the signed plugin directory before any plugin command is parsed in the script.

.changes/reuse-mobile-dev-reqwest-client.md

@@ -0,0 +1,5 @@
+---
+tauri: patch:perf
+---
+
+Reuse proxy reqwest client in mobile dev, improving the dev load speed

.changes/tray-icon-0.24.md

@@ -0,0 +1,5 @@
+---
+"tauri": "patch:deps"
+---
+
+Updated dependency `tray-icon` to 0.24

.changes/v1-migrate-aliased-plugin-imports.md

@@ -0,0 +1,8 @@
+---
+"tauri-cli": "patch:bug"
+"@tauri-apps/cli": "patch:bug"
+---
+
+Fix `tauri migrate` generating invalid namespace imports for aliased pluginified imports from `@tauri-apps/api`.
+
+Inputs like `import { cli as superCli } from "@tauri-apps/api"` now migrate to `import * as superCli from "@tauri-apps/plugin-cli"` instead of producing invalid ESM syntax. The migration tests also reparse migrated JS, Svelte, and Vue output so syntax regressions are caught directly.

.github/workflows/audit.yml

@@ -16,6 +16,8 @@ on:
       - '**/package.json'
       - '**/pnpm-lock.yaml'
   push:
+    branches:
+      - dev
     paths:
       - '.github/workflows/audit.yml'
       - '**/Cargo.lock'

.github/workflows/lint-rust.yml

@@ -12,6 +12,8 @@ on:
     paths:
       - '.github/workflows/lint-rust.yml'
       - 'crates/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
 
 env:
   RUST_BACKTRACE: 1

.github/workflows/publish-cli-js.yml

@@ -53,26 +53,34 @@ jobs:
             docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-debian
             build: |
               npm i -g --force corepack
+              rustup install 1.88.0
+              rustup default 1.88.0
               cd packages/cli
               pnpm build --target x86_64-unknown-linux-gnu
               strip *.node
           - host: ubuntu-22.04
             target: x86_64-unknown-linux-musl
             docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-alpine
             build: |
+              rustup install 1.88.0
+              rustup default 1.88.0
               cd packages/cli
               pnpm build
               strip *.node
           - host: macos-latest
             target: aarch64-apple-darwin
             build: |
+              rustup target add x86_64-apple-darwin
               pnpm build --features native-tls-vendored --target=aarch64-apple-darwin
               strip -x *.node
           - host: ubuntu-22.04
             target: aarch64-unknown-linux-gnu
             docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-debian-aarch64
             build: |
               npm i -g --force corepack
+              rustup install 1.88.0
+              rustup default 1.88.0
+              rustup target add aarch64-unknown-linux-gnu
               cd packages/cli
               pnpm build --target aarch64-unknown-linux-gnu
               aarch64-unknown-linux-gnu-strip *.node
@@ -90,8 +98,10 @@ jobs:
             target: aarch64-unknown-linux-musl
             docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-alpine
             build: |
-              cd packages/cli
+              rustup install 1.88.0
+              rustup default 1.88.0
               rustup target add aarch64-unknown-linux-musl
+              cd packages/cli
               pnpm build --target aarch64-unknown-linux-musl
               /aarch64-linux-musl-cross/bin/aarch64-linux-musl-strip *.node
           - host: ubuntu-22.04
@@ -107,6 +117,8 @@ jobs:
     runs-on: ${{ matrix.settings.host }}
     steps:
       - uses: actions/checkout@v4
+      - name: Prepare CEF package metadata and versions
+        run: node ../../.scripts/ci/prepare-cli-cef-publish.js
       - run: npm i -g --force corepack
       - name: Setup node
         uses: actions/setup-node@v4
@@ -136,7 +148,12 @@ jobs:
         if: ${{ matrix.settings.docker }}
         with:
           image: ${{ matrix.settings.docker }}
-          options: --user 0:0 -v ${{ github.workspace }}/.cargo-cache/git/db:/root/.cargo/git/db -v ${{ github.workspace }}/.cargo/registry/cache:/root/.cargo/registry/cache -v ${{ github.workspace }}/.cargo/registry/index:/root/.cargo/registry/index -v ${{ github.workspace }}:/build -w /build
+          options: --user 0:0 -v ${{ github.workspace
+            }}/.cargo-cache/git/db:/root/.cargo/git/db -v ${{ github.workspace
+            }}/.cargo/registry/cache:/root/.cargo/registry/cache -v ${{
+            github.workspace
+            }}/.cargo/registry/index:/root/.cargo/registry/index -v ${{
+            github.workspace }}:/build -w /build
           run: ${{ matrix.settings.build }}
 
       - name: Build
@@ -212,8 +229,8 @@ jobs:
           - host: windows-latest
             target: x86_64-pc-windows-msvc
         node:
-          - '18'
           - '20'
+          - '22'
     runs-on: ${{ matrix.settings.host }}
     steps:
       - uses: actions/checkout@v4
@@ -243,8 +260,8 @@ jobs:
       fail-fast: false
       matrix:
         node:
-          - '18'
           - '20'
+          - '22'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -278,8 +295,8 @@ jobs:
       fail-fast: false
       matrix:
         node:
-          - '18'
           - '20'
+          - '22'
     runs-on: ubuntu-latest
     container:
       image: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-alpine
@@ -319,8 +336,8 @@ jobs:
       fail-fast: false
       matrix:
         node:
-          - '18'
           - '20'
+          - '22'
         image:
           - ghcr.io/napi-rs/napi-rs/nodejs:aarch64-16
     runs-on: ubuntu-latest
@@ -345,7 +362,8 @@ jobs:
       - uses: addnab/docker-run-action@v3
         with:
           image: ${{ matrix.image }}
-          options: '-v ${{ github.workspace }}:/build -w /build -e RUSTUP_HOME=/usr/local/rustup -e CARGO_HOME=/usr/local/cargo'
+          options: '-v ${{ github.workspace }}:/build -w /build -e
+            RUSTUP_HOME=/usr/local/rustup -e CARGO_HOME=/usr/local/cargo'
           shell: bash
           run: |
             set -e
@@ -386,12 +404,14 @@ jobs:
           path: packages/cli/artifacts
       - name: Move artifacts
         run: pnpm artifacts
+      - name: Rewrite package names for CEF publish
+        run: node ../../.scripts/ci/prepare-cli-cef-publish.js
       - name: List packages
         run: ls -R ./npm
         shell: bash
       - name: Publish
         run: |
-          npm publish
+          npm publish --tag latest
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NODE_AUTH_TOKEN: ''

.github/workflows/publish-cli-rs.yml

@@ -76,22 +76,21 @@ jobs:
 
       - name: Build CLI
         if: ${{ !matrix.config.cross }}
-        run: cargo build --manifest-path ./crates/tauri-cli/Cargo.toml --profile release-size-optimized ${{ matrix.config.args }}
+        run: >-
+          cargo build --manifest-path ./crates/tauri-cli/Cargo.toml
+          --target ${{ matrix.config.rust_target }}
+          --profile release-size-optimized
+          ${{ matrix.config.args }}
 
       - name: Build CLI (cross)
         if: ${{ matrix.config.cross }}
-        run: cross build --manifest-path ./crates/tauri-cli/Cargo.toml --target ${{ matrix.config.rust_target }} --profile release-size-optimized ${{ matrix.config.args }}
+        run: >-
+          cross build --manifest-path ./crates/tauri-cli/Cargo.toml
+          --target ${{ matrix.config.rust_target }}
+          --profile release-size-optimized
+          ${{ matrix.config.args }}
 
       - name: Upload CLI
-        if: ${{ !matrix.config.cross }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: cargo-tauri-${{ matrix.config.rust_target }}${{ matrix.config.ext }}
-          path: target/release-size-optimized/cargo-tauri${{ matrix.config.ext }}
-          if-no-files-found: error
-
-      - name: Upload CLI (cross)
-        if: ${{ matrix.config.cross }}
         uses: actions/upload-artifact@v4
         with:
           name: cargo-tauri-${{ matrix.config.rust_target }}${{ matrix.config.ext }}

.github/workflows/test-cli-rs.yml

@@ -14,6 +14,8 @@ on:
       - 'crates/tauri-utils/**'
       - 'crates/tauri-bundler/**'
       - 'crates/tauri-cli/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
 
 env:
   RUST_BACKTRACE: 1

.github/workflows/test-core.yml

@@ -12,6 +12,8 @@ on:
     paths:
       - '.github/workflows/test-core.yml'
       - 'crates/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
       - '!crates/tauri/scripts/**'
       - '!crates/tauri-cli/**'
       - '!crates/tauri-bundler/**'

.scripts/ci/prepare-cli-cef-publish.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+
+// Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT
+
+const { readdirSync, readFileSync, writeFileSync } = require('node:fs')
+const { join } = require('node:path')
+
+const SOURCE_NAME = '@tauri-apps/cli'
+const TARGET_NAME = '@tauri-apps/cli-cef'
+
+const cliDir = process.cwd()
+const npmDir = join(cliDir, 'npm')
+const cefCliVersionPath = join(cliDir, '.cef-cli-version')
+const tauriCliCargoTomlPath = join(cliDir, '../../crates/tauri-cli/Cargo.toml')
+
+const cefCliVersion = readFileSync(cefCliVersionPath, 'utf8').trim()
+
+if (!cefCliVersion) {
+  throw new Error(`expected a version in ${cefCliVersionPath}`)
+}
+
+function rewritePackageName(packageJsonPath, setVersion = false) {
+  const pkg = JSON.parse(readFileSync(packageJsonPath, 'utf8'))
+  if (setVersion) {
+    pkg.version = cefCliVersion
+  }
+  if (typeof pkg.name === 'string' && pkg.name.startsWith(SOURCE_NAME)) {
+    pkg.name = pkg.name.replace(SOURCE_NAME, TARGET_NAME)
+  }
+  writeFileSync(packageJsonPath, `${JSON.stringify(pkg, null, 2)}\n`)
+  console.log(`updated package metadata in ${packageJsonPath}`)
+}
+
+rewritePackageName(join(cliDir, 'package.json'), true)
+
+for (const entry of readdirSync(npmDir, { withFileTypes: true })) {
+  if (!entry.isDirectory()) {
+    continue
+  }
+  rewritePackageName(join(npmDir, entry.name, 'package.json'))
+}
+
+const indexJsPath = join(cliDir, 'index.js')
+const indexContents = readFileSync(indexJsPath, 'utf8')
+const rewrittenIndexContents = indexContents.replace(
+  /@tauri-apps\/cli(?=[-/'"`])/g,
+  TARGET_NAME
+)
+
+if (rewrittenIndexContents !== indexContents) {
+  writeFileSync(indexJsPath, rewrittenIndexContents)
+  console.log(`rewrote native binding imports in ${indexJsPath}`)
+}
+
+const tauriCliCargoToml = readFileSync(tauriCliCargoTomlPath, 'utf8')
+const tauriCliCargoTomlWithVersion = tauriCliCargoToml.replace(
+  /^version = ".*"$/m,
+  `version = "${cefCliVersion}"`
+)
+
+if (tauriCliCargoTomlWithVersion !== tauriCliCargoToml) {
+  writeFileSync(tauriCliCargoTomlPath, tauriCliCargoTomlWithVersion)
+  console.log(`updated tauri-cli version in ${tauriCliCargoTomlPath}`)
+}