Sync upstream and integrate GTK4/WebKitGTK 6 ports#12
Merged
Conversation
feat(linux): integrate GTK4 WebKitGTK6 stack
fix(linux): clean GTK4 tray follow-ups
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…15694) Kotlin Gradle Plugin deprecated the string-based `kotlinOptions` DSL and 2.3+ rejects it with a hard error. Use the `compilerOptions` DSL with `JvmTarget.JVM_1_8` instead, which is accepted on both 1.9.x and 2.x, so projects can move to Kotlin 2.x without editing the vendored `:tauri-android` scripts.
* Migrate to svelte ts for API example * Clean up * Use `$derived` `selectedWebview` * Do the change in onchange instead of state effects * Set initial x y and sizes * revert ai slop on main.ts * More cleanup * Remove ConsoleMessage * Remove View type * license header * Use `ViewProps` * Use same button spacing through out * Move theme example to top level theme switch * Fix menu views * More cleanups * Final cleanup * Move types to svelte files * fallback to empty string not false
* fix(bundler): preserve mapped resource names in wix * Refactor the entire `generate_resource_data` * Add `ResourceFile::new` * Use back the hashmap but with entry * Remove `ResourceDirectory::name` and rely on `directories` * Fix tests * Fix git stage * Add change file * Make `target_name` optional * Cleanup --------- Co-authored-by: Tony <legendmastertony@gmail.com> Co-authored-by: Tony <68118705+Legend-Master@users.noreply.github.com>
…pps#15711) * fix: `referenced_by` compilation on different debug profiles * Guess `ResolvedCommandReference` can't be `debug_assertions` only anymore * no `const` or `the destructor for this type cannot be evaluated in constant functions` * Remove ToTokens guard for ResolvedCommandReference * Rely on `default` and empty out the `ResolvedCommandReference` * `ResolvedCommandReference` needs the same
* Migrate to svelte ts for API example * Clean up * Use `$derived` `selectedWebview` * Do the change in onchange instead of state effects * Set initial x y and sizes * revert ai slop on main.ts * More cleanup * Remove ConsoleMessage * Remove View type * license header * Use `ViewProps` * Use same button spacing through out * Move theme example to top level theme switch * Fix menu views * More cleanups * Merge branch 'dev' into api-example-svelte-ts * Final cleanup * Move types to svelte files * fallback to empty string not false * Initial work * Bump deps * Make dragging with states work * Fix sorting * Move everything to `MenuBuilder.svelte` * Add remove button * Fix Menu and Tray * Make menu items reactive * Sync checked states * Add placeholder to menu builder * Set user-select to none * Fix text in the console * Rework tray page layout * Close all menus on MenuBuilder unmounted * Clean up menus properly * Add initial text and icon on the menu builders * Move MenuItems to MenuBuilder * format * Merge branch 'dev' into api-example-svelte-ts * Merge branch 'api-example-svelte-ts' into menu-example-rework * Re-create all the elements as a work around * Reorder the menu items on builder changes * On one tray for the tray page * Update menus on add and remove * Same for the tray * Space and align checkboxes * Merge remote-tracking branch 'upstream/dev' into menu-example-rework * Clean up menus properly * Merge branch 'dev' into menu-example-rework * Remove duplicated webview in new command * Merge branch 'dev' into menu-example-rework
* fix(ci): bump all setup-node action versions * NAPI on node 22 as well * remove covector node version lock
…i-apps#15729) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…5644) * feat(bundler): show bundle sizes in the finished output Append a human-readable size to each bundle path in the "Finished N bundles at:" log, so the sizes are visible right after `tauri build` instead of having to look them up manually. Directory bundles (e.g. macOS `.app`) are measured recursively. Closes tauri-apps#15341 * chore: include tauri-cli in changefile * refactor(bundler): use human_bytes crate for size formatting * Also `@tauri-apps/cli` * Change to use bytesize for 2 digit precisions And fail instead of reporting partial sizes --------- Co-authored-by: Tony <legendmastertony@gmail.com>
…pps#15730) * Use `Theme.Material3.DayNight.NoActionBar` by default * Fix insets on Android * Add change file * Revert back to margin-top: 0.5rem * Align content start
* refactor: rename `extend_api` to `run_invoke_handler` * Link docs * unwrap_or_else
* clean up and docs * Remove menu channel on drop * Why was the mut gone * Clone the channel out * Keep `unreachable_code` * Put it back to a block * Move the cloned channel out so no nuances * Add change file
This allows the unstyled user agent elements match the selected theme colors
* fix: menu regression from tauri-apps#15679 * change init order instead
…pps#13848) * Draft: Add `WebviewBuilder::limit_navigations_to_app_bound_domains` only on iOS. * removed cfg flag from new setters * change version bump to minor * fix clippy lint for limit_navigations_to_app_bound_domains * add tauri.conf.json support, polish doc comments * add back missing comma, autogenerate config files * minor documentation formatting changes * Fix limitNavigationsToAppBoundDomains config binding, edit documentation. * Have the CLI automatically inject `localhost` into the `WKAppBoundDomains` array in `Info.plist` when `limitNavigationsToAppBoundDomains` is enabled. Update the `merge_plist` helper to merge arrays in place while skipping duplicate entries. * Extract all window domains for WKAppBoundDomains array * refine docs for limit_navigations_to_app_bound_domains WindowConfig parameter * Revert automatic insertion of WKAppBoundDomains, update documentation to match. * have docs specify tauri-src/Info.ios.plist * cli doesn't have changes anymore * Combine ios blocks * Remove duplicated builder call * format --------- Co-authored-by: Tony <68118705+Legend-Master@users.noreply.github.com> Co-authored-by: Tony <legendmastertony@gmail.com>
# Conflicts: # .github/workflows/audit.yml
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR migrates the Linux GUI stack from GTK3/WebKit2GTK to GTK4/WebKitGTK6 across runtime, bundler, and CLI crates; adds an iOS app-bound-domains navigation feature; introduces vendored ChangesGTK4/WebKit6 Runtime Migration and Core Features
Estimated code review effort: 5 (Critical) | ~150 minutes Vendored Port Crates
CI, Tooling, and Frontend Modernization
Estimated code review effort: 4 (Complex) | ~90 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
OlympusLedgerOrg
marked this pull request as ready for review
July 19, 2026 18:48
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 17
Note
Due to the large number of review comments, Critical, Major severity comments were prioritized as inline comments.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
crates/tauri-cli/templates/plugin/.github/workflows/clippy.yml (1)
1-1: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winPlugin CI templates still install
webkit2gtk-4.1— should be updated for GTK4/WebKitGTK6 migration. The PR migrates the runtime from GTK3/WebKit2GTK 4.1 to GTK4/WebKitGTK6, but the plugin template workflows still install the oldwebkit2gtk-4.1development package. Plugins built against the new Tauri stack will fail CI on Ubuntu because the required GTK4/WebKitGTK6 development headers are not installed.
crates/tauri-cli/templates/plugin/.github/workflows/clippy.yml#L48-52: Update theinstall webkit2gtkstep to install the GTK4/WebKitGTK6 development packages (e.g.,libwebkitgtk-6.0-dev,libgtk-4-dev) instead ofwebkit2gtk-4.1.crates/tauri-cli/templates/plugin/.github/workflows/test.yml#L28-32: Same update needed — replacewebkit2gtk-4.1with the appropriate GTK4/WebKitGTK6 packages.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/tauri-cli/templates/plugin/.github/workflows/clippy.yml` at line 1, Update the plugin workflow templates’ dependency-install steps in clippy.yml and test.yml to remove webkit2gtk-4.1 and install the GTK4/WebKitGTK6 development packages required by the migrated Tauri stack, including libwebkitgtk-6.0-dev and libgtk-4-dev.
🟡 Minor comments (26)
.changes/tauri-info-skip-rust-only-js.md-6-6 (1)
6-6: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winClarify the reported behavior.
As written, this says
tauri infocorrectly reports a nonexistent npm package as not installed. Describe the actual fix instead, for example: “Fixtauri infofrom reporting Rust-only plugins as having a missing npm package.”🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.changes/tauri-info-skip-rust-only-js.md at line 6, Update the changelog entry to describe the actual fix: prevent `tauri info` from reporting Rust-only plugins as having a missing npm package, rather than stating that nonexistent npm packages are reported as not installed..changes/android-compileroptions-dsl.md-9-9 (1)
9-9: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winPolish the affected release-note wording.
Please correct these grammatical and clarity issues:
.changes/android-compileroptions-dsl.md#L9: say “if your Gradle version is earlier.”.changes/cleanup-js-menu-channel.md#L5: use “Remove theChannelused to send events to the JavaScript side when the menu is dropped.”.changes/fix-wix-resource-target-name.md#L8: use “Fix the WiX bundler so it respects the resource’s target file name.”.changes/resolved-command-reference-debug-assertion.md#L8: replace “can resulting” with “can result,” and clarify the affected build/runtime profiles.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.changes/android-compileroptions-dsl.md at line 9, Polish the release-note wording at .changes/android-compileroptions-dsl.md:9 to say “if your Gradle version is earlier”; at .changes/cleanup-js-menu-channel.md:5 to use “Remove the `Channel` used to send events to the JavaScript side when the menu is dropped”; at .changes/fix-wix-resource-target-name.md:8 to use “Fix the WiX bundler so it respects the resource’s target file name”; and at .changes/resolved-command-reference-debug-assertion.md:8 to replace “can resulting” with “can result” and clarify the affected build/runtime profiles.examples/api/src/views/Tray.svelte-117-131 (1)
117-131: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
menuresource leaks on every "Remove tray" → "Create tray" cycle.The remove-tray handler closes/resets
traybut never closesmenu.create()unconditionally overwritesmenuon the next click, so the previousMenuresource is never released.Menu.svelte'ssetMenu()closes prior resources before reassigning — this handler should do the same.🔧 Proposed fix
{`#if` tray} <button class="btn" onclick={() => { tray?.close() tray = undefined + menu?.close() + menu = undefined }} title="Remove the tray icon">Remove tray</button >🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@examples/api/src/views/Tray.svelte` around lines 117 - 131, Update the “Remove tray” handler in the tray conditional to close and reset the existing menu resource before closing and clearing tray, reusing the cleanup behavior established by Menu.svelte’s setMenu(). Ensure each remove/create cycle releases the prior menu instead of allowing create() to overwrite it.examples/api/src/views/Tray.svelte-29-50 (1)
29-50: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winClose the menu when removing the tray
Remove trayclosestraybut leavesmenuopen; the nextcreate()overwrites it and leaks the previous native menu handle.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@examples/api/src/views/Tray.svelte` around lines 29 - 50, The tray removal flow must also close and clear the existing menu handle. Update the remove-tray logic to call menu.close() and set menu to undefined alongside the existing tray cleanup, preventing create() from overwriting a live native menu.examples/api/src/views/WebRTC.svelte-38-40 (1)
38-40: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winMessage renders
[object Object]and has a typo.
${constraints}interpolates an object as[object Object]; useJSON.stringify(constraints). Also "satisified" → "satisfied".✏️ Proposed fix
onMessage( - `The constraints ${constraints} can not be satisified by your device.` + `The constraints ${JSON.stringify(constraints)} can not be satisfied by your device.` )🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@examples/api/src/views/WebRTC.svelte` around lines 38 - 40, Update the onMessage call in WebRTC.svelte to serialize constraints with JSON.stringify(constraints) instead of implicit object interpolation, and correct “satisified” to “satisfied” in the message text.examples/api/src/app.css-54-55 (1)
54-55: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winStylelint error will fail lint CI.
declaration-empty-line-beforeis flagged at Line 55. Add the expected empty line to keep the lint pipeline green.💚 Proposed fix
`#sidebar` { --translate-x: -18.75rem; + transform: translateX(var(--translate-x)); }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@examples/api/src/app.css` around lines 54 - 55, Add the required empty line before the transform declaration in the relevant app.css rule, preserving the existing --translate-x declaration and transform behavior while satisfying Stylelint’s declaration-empty-line-before rule.Source: Linters/SAST tools
crates/tauri/src/menu/plugin.rs-890-892 (1)
890-892: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winMake menu-channel cleanup ownership-aware.
MenuChannelsis app-wide and keyed only byMenuId, whilenewoverwrites existing entries withinsert(id, handler). If explicit IDs can be reused across live menus, dropping one wrapper can remove the newer handler and break event routing for the remaining menu. Consider enforcing uniqueness or storing/removing the channel by resource ownership instead of bareMenuId.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/tauri/src/menu/plugin.rs` around lines 890 - 892, Make MenuChannels cleanup ownership-aware in remove_menu_channel and the corresponding new registration path: prevent a dropped menu from removing a newer handler registered under the same MenuId. Track the owning menu/resource or otherwise verify the stored handler belongs to the dropping wrapper before removal, while preserving routing for the active menu..github/workflows/udeps.yml-53-53 (1)
53-53: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winExpand udeps coverage for all vendored port crates.
ports/**only routes changes into thewrymatrix entry, so edits underports/muda,ports/tao, andports/tray-iconskip udeps entirely. Wirevendor/wayland-scanner/**into the same coverage too, since those crates depend on it.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/udeps.yml at line 53, Update the udeps workflow path-to-matrix routing around the existing ports/** entry so changes under ports/muda, ports/tao, ports/tray-icon, and vendor/wayland-scanner are covered by the appropriate udeps matrix entries, rather than only routing ports/** through wry. Preserve existing coverage while ensuring each named vendored crate triggers udeps..github/workflows/covector-version-or-publish.yml-73-75 (1)
73-75: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winDisable checkout credential persistence in these workflows.
Add
persist-credentials: falseto the listedactions/checkoutsteps unless a later step needs to push with the checkout token.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/covector-version-or-publish.yml around lines 73 - 75, Disable checkout credential persistence for every listed actions/checkout step by adding persist-credentials: false: .github/workflows/covector-version-or-publish.yml lines 73-75 and 22-24, .github/workflows/check-license-header.yml line 18, .github/workflows/covector-status.yml lines 13-15, .github/workflows/docker.yml lines 19-20 and 62-63, and .github/workflows/fmt.yml lines 15, 28, and 41. Do not add it only where a later step requires the checkout token to push.Source: Linters/SAST tools
ports/muda/.changes/config.json-8-11 (1)
8-11: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winPrepublish deps still target GTK3. The crate now links
gtk4(see.changes/gtk4.md), butprepublishinstallslibgtk-3-dev. Sincepublishrunscargo publish --dry-run(line 24), which compiles the crate, the dry-run build would lack the GTK4 development headers.🔧 Proposed fix
"prepublish": [ "sudo apt-get update", - "sudo apt-get install -y libgtk-3-dev libxdo-dev" + "sudo apt-get install -y libgtk-4-dev libxdo-dev" ],🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ports/muda/.changes/config.json` around lines 8 - 11, Update the prepublish dependency list in config.json to install the GTK4 development package required by the crate instead of libgtk-3-dev. Keep the existing libxdo-dev dependency and command ordering unchanged so the publish dry-run has the required headers.ports/muda/src/platform_impl/gtk/mod.rs-275-275 (1)
275-275: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winUse a pointer-sized key for GTK windows
window.as_ptr() as u32truncates the pointer on 64-bit builds, so distinct windows can collide inself.instancesand get the wrong menu state across init/show/hide/remove. Please switch these keys to a pointer-sized type (usizeor equivalent) everywhere this cast is repeated.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ports/muda/src/platform_impl/gtk/mod.rs` at line 275, Replace the u32 GTK window key derived from window.as_ptr() with a pointer-sized type such as usize, and update all corresponding self.instances key declarations, lookups, inserts, and removals across init/show/hide/remove flows to use the same type consistently.ports/muda/README.md-33-49 (1)
33-49: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winInstall instructions still reference GTK3 for a GTK4 port.
This crate is ported to GTK4/WebKitGTK6, but the dependency instructions tell users to install
gtk3/libgtk-3-dev/gtk3. Builders following this will pull the wrong dev packages. Please update to the GTK4 equivalents (e.g.gtk4,libgtk-4-dev).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ports/muda/README.md` around lines 33 - 49, Update the README dependency installation commands for the GTK4/WebKitGTK6 port: replace GTK3 packages in the Debian/Ubuntu and FreeBSD sections, including libgtk-3-dev and gtk3, with the appropriate GTK4 development packages such as libgtk-4-dev and gtk4. Keep the existing installation structure and other dependencies unchanged.ports/muda/examples/windows-common-controls-v6/src/main.rs-224-233 (1)
224-233: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winLinux GTK branch is still broken here.
ContextMenuexposesshow_context_menu_for_gtk_window(...), notshow_context_menu_for_gtk(...), and this file doesn’t importtao::platform::unix::WindowExtUnixforgtk_window(). Mirror the other examples and gate/comment out this path until the GTK4 API is wired up.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ports/muda/examples/windows-common-controls-v6/src/main.rs` around lines 224 - 233, Update the Linux/Unix GTK branch in the main window context-menu flow to match the other examples: do not call the unavailable ContextMenu::show_context_menu_for_gtk API, and gate or comment out this path until GTK4 support is wired up, avoiding gtk_window() unless the required WindowExtUnix integration is present.ports/muda/src/lib.rs-390-398 (1)
390-398: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winDoc comment mismatch: Windows-only method references
NSView.
detach_menu_subclass_from_hwndis#[cfg(target_os = "windows")], but its doc text ("The view must be a pointer to a validNSView") appears copy-pasted from the macOSshow_context_menu_for_nsviewdoc.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ports/muda/src/lib.rs` around lines 390 - 398, The documentation for the Windows-only detach_menu_subclass_from_hwnd method incorrectly references NSView. Replace that sentence with Windows-appropriate wording describing the hwnd as a valid window handle, while preserving the existing safety requirement and method behavior.ports/muda/src/items/predefined.rs-6-6 (1)
6-6: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winSame "0" → "inner" corruption repeated across the ported
items/*.rsfiles.All three files carry an identical SPDX header typo, and
predefined.rsadditionally shows the same corruption in test fixture strings — evidence this is one mechanical substitution bug from the porting process rather than three independent typos.
ports/muda/src/items/predefined.rs#L6-L6: fixApache-2.inner→Apache-2.0in the second SPDX header.ports/muda/src/items/predefined.rs#L226-L243: fix"Version: 1.inner"→"Version: 1.0"in thetest_about_metadatafixtures/assertions.ports/muda/src/items/icon.rs#L6-L6: fixApache-2.inner→Apache-2.0in the second SPDX header.ports/muda/src/items/submenu.rs#L6-L6: fixApache-2.inner→Apache-2.0in the second SPDX header.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ports/muda/src/items/predefined.rs` at line 6, The ported muda item files contain mechanical “0” to “inner” substitutions. In ports/muda/src/items/predefined.rs at lines 6 and 226-243, replace the corrupted SPDX and test fixture/assertion strings with the correct “Apache-2.0” and “Version: 1.0” values; make the same SPDX correction in ports/muda/src/items/icon.rs at line 6 and ports/muda/src/items/submenu.rs at line 6.ports/muda/src/lib.rs-28-42 (1)
28-42: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winUpdate the Linux install commands to GTK4 The crate depends on
gtk4on Linux, so these instructions should usepacman -S gtk4 xdotoolandsudo apt install libgtk-4-dev libxdo-dev.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ports/muda/src/lib.rs` around lines 28 - 42, Update the Linux dependency installation commands in the crate documentation to match the gtk4 dependency: use gtk4 with pacman and libgtk-4-dev with apt, while retaining the existing xdotool packages.ports/muda/src/items/check.rs-5-7 (1)
5-7: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrupted SPDX identifier:
Apache-2.innershould beApache-2.0.This is the only file in the batch with this typo; the matching header block in sibling files (e.g. builders/check.rs, error.rs, icon.rs) correctly reads
Apache-2.0.🐛 Proposed fix
// Copyright 2022-2022 Tauri Programme within The Commons Conservancy -// SPDX-License-Identifier: Apache-2.inner +// SPDX-License-Identifier: Apache-2.0 // SPDX-License-Identifier: MIT🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ports/muda/src/items/check.rs` around lines 5 - 7, Correct the SPDX license identifier in the header of check.rs from Apache-2.inner to Apache-2.0, leaving the surrounding copyright and MIT license lines unchanged.ports/muda/src/builders/icon.rs-115-117 (1)
115-117: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
set_key_acceleratorerror is silently discarded inbuild.The
let _ =on line 116 discards theResultfromset_key_accelerator. If the platform-specific accelerator assignment fails, the user gets a menu item without the accelerator and no error indication, despite having explicitly set one viaaccelerator()orkey_accelerator().Consider propagating the error or at minimum logging it, so accelerator failures aren't invisible.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ports/muda/src/builders/icon.rs` around lines 115 - 117, Update the key accelerator handling in build so the Result from item.set_key_accelerator is not silently discarded. Propagate the assignment error through the existing build error path, preserving the configured accelerator behavior and making platform-specific failures visible to the caller.ports/tray-icon/README.md-43-43 (1)
43-43: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winFreeBSD instructions still reference
gtk3instead ofgtk4.This PR migrates the Linux stack to GTK4/WebKitGTK6. The Arch Linux (line 29) and Debian (line 35) sections correctly reference
gtk4/libgtk-4-dev, but the FreeBSD section still installsgtk3. This should begtk4to match the migration.📝 Proposed fix
- pkg install -y rust glib pkgconf gtk3 + pkg install -y rust glib pkgconf gtk4🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ports/tray-icon/README.md` at line 43, Update the FreeBSD dependency installation command in the README to install gtk4 instead of gtk3, keeping the other packages and platform instructions unchanged.ports/tray-icon/src/platform_impl/linux/icon.rs-20-20 (1)
20-20: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
is_multiple_ofneeds a lower-MSRV fallback
ports/tray-icon/Cargo.tomlstill pinsrust-version = "1.73", andusize::is_multiple_ofneeds Rust 1.82+, so this won’t build on the declared MSRV. Usergba.len() % 4 == 0here unless the crate MSRV is raised first.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ports/tray-icon/src/platform_impl/linux/icon.rs` at line 20, Update the condition near the Linux icon RGBA validation to use the modulo-based multiple-of check instead of usize::is_multiple_of, preserving the existing invalid-length branch while remaining compatible with the crate’s Rust 1.73 MSRV.ports/tray-icon/src/platform_impl/gtk/mod.rs-146-163 (1)
146-163: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winTest assertion hardcodes
/tmpbuttemp_dir()may differ.Line 163 asserts
dir3 == PathBuf::from("/tmp/tray-icon"), buttemp_icon_pathfalls back tostd::env::temp_dir().join("tray-icon")whenXDG_RUNTIME_DIRis unset. On Linux,std::env::temp_dir()returns$TMPDIRif set, which may not be/tmp. IfTMPDIRis set in the CI environment, this test will fail.Proposed fix
- assert_eq!(dir3, PathBuf::from("/tmp/tray-icon")); + assert_eq!(dir3, std::env::temp_dir().join("tray-icon"));🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ports/tray-icon/src/platform_impl/gtk/mod.rs` around lines 146 - 163, Update the final assertion in temp_icon_path_preference_order to compare dir3 with std::env::temp_dir().join("tray-icon") instead of hardcoding /tmp, preserving the expected fallback behavior when XDG_RUNTIME_DIR is unset.ports/tray-icon/src/platform_impl/gtk/icon.rs-46-58 (1)
46-58: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick winExplicitly flush the
BufWriterto avoid silent data loss.The
BufWriteris created as an unnamed temporary (&mut BufWriter::new(png)). When it's dropped at the end of the function,BufWriter::Dropcallsflush()but silently discards errors. If the final flush fails (e.g., disk full),write_to_pngreturnsOk(())but the PNG file is truncated. Restructure to use a named binding and flush explicitly.Proposed fix
pub fn write_to_png(&self, path: impl AsRef<Path>) -> crate::Result<()> { let png = File::create(path)?; - let w = &mut BufWriter::new(png); - - let mut encoder = png::Encoder::new(w, self.width as _, self.height as _); - encoder.set_color(png::ColorType::Rgba); - encoder.set_depth(png::BitDepth::Eight); - - let mut writer = encoder.write_header()?; - writer.write_image_data(&self.rgba)?; - - Ok(()) + let mut w = BufWriter::new(png); + + { + let mut encoder = png::Encoder::new(&mut w, self.width as _, self.height as _); + encoder.set_color(png::ColorType::Rgba); + encoder.set_depth(png::BitDepth::Eight); + + let mut writer = encoder.write_header()?; + writer.write_image_data(&self.rgba)?; + } + + w.flush()?; + Ok(()) }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ports/tray-icon/src/platform_impl/gtk/icon.rs` around lines 46 - 58, Update write_to_png to store the BufWriter in a named mutable binding rather than borrowing an unnamed temporary, then explicitly flush it after write_image_data completes and propagate any flush error before returning Ok. Keep the existing PNG encoding behavior unchanged.ports/muda/src/menu.rs-5-7 (1)
5-7: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrupted SPDX identifier in the license header.
Line 6 reads
Apache-2.innerinstead ofApache-2.0— likely collateral from an automated.0→.innerrefactor. This is an invalid SPDX id and can break SPDX/license-header checks. The same header inports/muda/src/util.rscorrectly usesApache-2.0.🔧 Proposed fix
// Copyright 2022-2022 Tauri Programme within The Commons Conservancy -// SPDX-License-Identifier: Apache-2.inner +// SPDX-License-Identifier: Apache-2.0 // SPDX-License-Identifier: MIT🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ports/muda/src/menu.rs` around lines 5 - 7, Correct the SPDX identifier in the license header of ports/muda/src/menu.rs from Apache-2.inner to Apache-2.0, matching the valid identifier used by the neighboring util.rs header.ports/tray-icon/examples/winit.rs-134-140 (1)
134-140: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick winReplace the GTK 3-style main loop
gtkis already aliased togtk4on this target, but GTK 4 has nogtk::main(). Switch this example to the GTK 4 application/main-loop pattern, or it won't build on Linux/BSD.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ports/tray-icon/examples/winit.rs` around lines 134 - 140, Update the GTK initialization thread around Application::new_tray_icon to use the GTK 4 application/main-loop pattern instead of the unavailable gtk::main() call. Ensure the tray icon remains alive and the GTK 4 event loop is started through the appropriate application mechanism.crates/tauri-bundler/src/bundle.rs-306-319 (1)
306-319: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
bundle_sizealso sums directory entries, inflating reported size.
WalkDir::new(path)yields directory entries as well as files, and theirmetadata().len()(the directory's own inode footprint, not its contents) is added tototal. For bundles with many nested subdirectories this measurably inflates the size shown in the "Finished" log line.🩹 Proposed fix: only sum file entries
fn bundle_size(path: &std::path::Path) -> crate::Result<u64> { let metadata = std::fs::symlink_metadata(path)?; if metadata.is_dir() { let mut total = 0; for entry in walkdir::WalkDir::new(path) { - total += entry?.metadata()?.len(); + let entry = entry?; + if entry.file_type().is_file() { + total += entry.metadata()?.len(); + } } Ok(total) } else { Ok(metadata.len()) } }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/tauri-bundler/src/bundle.rs` around lines 306 - 319, Update bundle_size to sum only file entries when recursively walking directories, excluding directory entries from the total while preserving symlink and error handling behavior for included files.crates/tauri-cli/config.schema.json-617-621 (1)
617-621: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrect the documented iOS plist path.
Line 618 points users to
tauri-src/Info.ios.plist. Verify the canonical project layout and update the source documentation and generated schema to usesrc-tauri/Info.ios.plist; otherwise users may placeWKAppBoundDomainswhere Tauri will not load it.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/tauri-cli/config.schema.json` around lines 617 - 621, Update the description for the limitNavigationsToAppBoundDomains schema property and its source documentation to reference the canonical src-tauri/Info.ios.plist path instead of tauri-src/Info.ios.plist, preserving the surrounding WKAppBoundDomains guidance.
🧹 Nitpick comments (6)
.github/workflows/covector-version-or-publish.yml (1)
26-26: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winUse a pinned Corepack installation consistently.
.github/workflows/covector-version-or-publish.yml#L26-L26: replace the unpinned global install with the repository’s pinned toolchain..github/workflows/covector-version-or-publish.yml#L76-L76: apply the same deterministic installation in the publish job..github/workflows/fmt.yml#L29-L29: avoid resolving a mutable npm package during formatting CI.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/covector-version-or-publish.yml at line 26, Replace the unpinned Corepack installation at .github/workflows/covector-version-or-publish.yml:26-26 with the repository’s pinned toolchain, and apply the same deterministic installation at .github/workflows/covector-version-or-publish.yml:76-76 and .github/workflows/fmt.yml:29-29. Avoid resolving Corepack through a mutable global npm package in all three workflow sites.Source: Linters/SAST tools
.github/workflows/lint-js.yml (1)
22-22: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winMake the Corepack bootstrap reproducible.
The same unpinned global installation appears in multiple workflows.
- .github/workflows/lint-js.yml#L22-L22: pin Corepack or use the declared package-manager setup.
- .github/workflows/lint-js.yml#L34-L34: apply the same pinned setup.
- .github/workflows/publish-cli-js.yml#L80-L80: pin the global Corepack package.
- .github/workflows/test-android.yml#L46-L46: pin the global Corepack package.
- .github/workflows/test-cli-js.yml#L41-L41: pin the global Corepack package.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/lint-js.yml at line 22, Make Corepack bootstrapping reproducible by pinning the globally installed Corepack version or reusing the repository’s declared package-manager setup. Apply the same change at both sites in .github/workflows/lint-js.yml (lines 22 and 34), plus .github/workflows/publish-cli-js.yml (line 80), .github/workflows/test-android.yml (line 46), and .github/workflows/test-cli-js.yml (line 41).Source: Linters/SAST tools
ports/muda/src/icon.rs (1)
116-140: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueTest gap:
PngEncodingErrorsource passthrough isn't covered.New tests only exercise
ByteCountNotDivisibleBy4,DimensionsVsPixelCount, andOsError; the cfg-gatedPngEncodingErrorbranch (Lines 82-84, 103) added for Linux/BSD+gtkbuilds has no corresponding test.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ports/muda/src/icon.rs` around lines 116 - 140, Add a cfg-gated unit test in the tests module for BadIcon::PngEncodingError, constructing it with a representative encoding error and asserting source() returns Some. Match the existing Linux/BSD+gtk configuration guards used by the variant and preserve the current tests unchanged.ports/tray-icon/.changes/config.json (1)
9-10: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winPrepublish deps still target GTK3 after the GTK4 migration. This port moved to GTK4/WebKitGTK6 (the
lib.rsdocs now instructlibgtk-4-dev), but the covector prepublish step installslibgtk-3-devandlibayatana-appindicator3-dev. Sincecargo publishbuilds the crate, these stale dev packages may not satisfy the gtk4 build during release.♻️ Align prepublish deps with GTK4
"prepublish": [ "sudo apt-get update", - "sudo apt-get install -y libgtk-3-dev libxdo-dev libayatana-appindicator3-dev" + "sudo apt-get install -y libgtk-4-dev libxdo-dev libayatana-appindicator3-dev" ],Confirm whether the ksni backend still needs appindicator here.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ports/tray-icon/.changes/config.json` around lines 9 - 10, Update the prepublish dependency commands in the changes configuration to install the GTK4 development package required by the migrated port, replacing the stale GTK3 package. Verify whether the ksni backend still requires libayatana-appindicator3-dev; remove it if no longer needed, otherwise retain it alongside the GTK4 dependency.crates/tauri-bundler/src/bundle/windows/msi/mod.rs (1)
162-204: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winNon-deterministic
directoriesiteration order inrender_wix.
ResourceDirectory.directoriesis aHashMap<String, ResourceDirectory>; iterating it at line 184 to build the WiX XML means the generatedmain.wxsfragment's directory/component ordering will vary between builds of the same inputs (Rust's defaultHashMapuses a randomized hasher). Consider aBTreeMap(or sorting keys before iterating) for deterministic, reproducible build output.♻️ Suggested fix
- directories: HashMap<String, ResourceDirectory>, + directories: std::collections::BTreeMap<String, ResourceDirectory>,🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/tauri-bundler/src/bundle/windows/msi/mod.rs` around lines 162 - 204, Make the directory traversal in render_wix deterministic by iterating ResourceDirectory.directories in sorted key order, either by changing its map type to BTreeMap or sorting the HashMap keys before rendering. Preserve the existing recursive render_wix behavior and file ID collection order.crates/tauri-cli/templates/mobile/android/app/build.gradle.kts (1)
59-62: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winAlign Java and Kotlin bytecode targets.
This template pins Kotlin to JVM 1.8 but does not set
android.compileOptionsor a Java toolchain. AGP/toolchain defaults can differ, while Kotlin validates JVM-target compatibility; generated apps may therefore vary or fail to build. Add Java 1.8sourceCompatibilityandtargetCompatibility, matchingcrates/tauri-cli/templates/plugin/android/build.gradle.ktslines 28-30. (kotlinlang.org)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/tauri-cli/templates/mobile/android/app/build.gradle.kts` around lines 59 - 62, Add Android compileOptions to the template’s Gradle configuration alongside the kotlin compilerOptions block, setting Java sourceCompatibility and targetCompatibility to Java 1.8. Match the established configuration used by the plugin Android build template so Java and Kotlin bytecode targets remain aligned.Source: MCP tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/check-change-tags.yml:
- Line 20: Add persist-credentials: false to every listed actions/checkout step:
.github/workflows/check-change-tags.yml:20-20,
.github/workflows/check-generated-files.yml:29-29, 48-48, and 68-68, and
.github/workflows/udeps.yml:35-35, 79-79, and 130-130. Do not alter checkout
steps that genuinely require credentials to push changes.
In @.github/workflows/check-generated-files.yml:
- Around line 49-50: Replace the unpinned global Corepack install before
actions/setup-node with a pinned pnpm/action-setup or exact Corepack version.
Ensure the pnpm shim is enabled before setup-node runs with cache: 'pnpm',
preserving the workflow’s existing setup order and behavior.
In @.github/workflows/covector-version-or-publish.yml:
- Line 112: Update the peter-evans/create-pull-request action reference in the
workflow to the specified immutable commit SHA, preserving the existing v8.1.1
version comment.
In @.github/workflows/lint-js.yml:
- Line 21: Disable checkout credential persistence by adding
persist-credentials: false to every actions/checkout step in
.github/workflows/lint-js.yml (lines 21-21 and 33-33),
.github/workflows/publish-cli-js.yml (79-79),
.github/workflows/publish-cli-rs.yml (48-48 and 103-103),
.github/workflows/test-android.yml (34-34), .github/workflows/test-cli-js.yml
(36-36), .github/workflows/test-cli-rs.yml (47-47), and
.github/workflows/test-core.yml (80-80).
In @.github/workflows/test-android.yml:
- Line 75: Update the workflow step that defines the `directory` variable to
consume an `NDK_PATH` environment variable instead of interpolating
`steps.setup-ndk.outputs.ndk-path` directly in the shell. Populate `NDK_PATH`
from that step output via the workflow step’s `env` configuration, while
preserving the existing `${prebuilt}/bin` path construction.
In @.github/workflows/test-cli-rs.yml:
- Line 17: Extend the path filters in .github/workflows/test-cli-rs.yml at lines
17-17 and .github/workflows/test-core.yml at lines 15-15 to include
vendor/wayland-scanner/** (or vendor/**), ensuring changes to the vendored
scanner trigger both CI workflows.
In `@crates/tauri-cli/templates/plugin/android/build.gradle.kts`:
- Around line 34-36: Close both Kotlin DSL blocks opened by the kotlin
configuration: add the missing closing braces after the jvmTarget assignment in
the kotlin block, ensuring the generated build.gradle.kts remains syntactically
valid.
In `@crates/tauri-runtime-wry/src/lib.rs`:
- Around line 3347-3349: Update the WindowMessage::GtkWindow handling and the
RawWindow::gtk_window contract consistently: either preserve the concrete
gtk::ApplicationWindow type by avoiding upcast_ref(), or change the field and
all dependent uses to accept gtk::Window. Ensure the value sent through
GtkWindow matches the declared type without relying on an incompatible
conversion.
In `@crates/tauri/src/app.rs`:
- Line 2386: Update the core-plugin registration flow around
register_core_plugins() and initialize_plugins() so each core plugin is
initialized exactly once. Prefer registering core plugins without triggering
immediate initialization, or make initialize_plugins() skip entries already
initialized, while preserving the existing user-plugin initialization ordering
and behavior.
In `@examples/api/src/views/WebRTC.svelte`:
- Around line 15-25: Update handleSuccess to assign the received stream to the
component’s mediaStream variable before exposing it through window.stream and
using it for playback. Preserve the existing cleanup path so onDestroy can call
getTracks() and stop every track when the view unmounts.
In `@examples/api/src/views/Window.svelte`:
- Around line 181-184: Update the minimize function to pass an arrow callback to
setTimeout that invokes selectedWebview.unminimize(), preserving the
selectedWebview context when the delayed method executes.
In `@ports/muda/.github/workflows/test.yml`:
- Around line 36-40: Update the install system deps step for the Ubuntu matrix
in the workflow: remove the redundant libgtk-3-dev package and replace
libwebkit2gtk-4.1-dev with the GTK4/WebKitGTK 6 development package required by
the local wry dependency and examples/wry.rs, while retaining the existing GTK4,
libxdo, and update commands.
In `@ports/muda/src/lib.rs`:
- Around line 461-480: Fix ContextMenu::as_submenu_unchecked to delegate to
self.as_submenu() rather than self.as_menu(), preserving its declared return
type and "Not a Submenu" panic behavior for non-Submenu contexts.
In `@ports/tao/src/platform_impl/linux/window.rs`:
- Around line 841-846: The unsafe Send and Sync guarantees for GTK4/Linux Window
are unsound because GTK reads and mutations bypass the event-loop channel.
Update Window and its affected methods, including set_focusable, the listed
getters, and raw_window_handle_* methods, to marshal every GTK access through
window_requests_tx with response channels for getters, or otherwise
narrow/remove the unsafe bounds to match actual safety;
ports/tao/tests/send_objects.rs lines 10-14 and 26-30 requires no direct change
and should not be treated as proof of thread safety.
In `@ports/tray-icon/.github/workflows/clippy-fmt.yml`:
- Around line 32-42: Update the Ubuntu dependency installation step in the
workflow to include libgtk-4-dev, ensuring cargo clippy --all-targets
--all-features can build the Linux gtk4 dev dependency while preserving the
existing package installations and clippy configuration.
In `@ports/tray-icon/.github/workflows/test.yml`:
- Around line 38-46: Update the Ubuntu dependency installation step in the
workflow to install libgtk-4-dev instead of libgtk-3-dev, while preserving the
existing libxdo-dev and libayatana-appindicator3-dev packages and the Rust
build/test steps.
In `@ports/tray-icon/src/platform_impl/gtk/icon.rs`:
- Line 22: Update the RGBA length validation around the is_multiple_of call to
remain compatible with the crate’s Rust 1.73 MSRV by replacing it with an
equivalent modulus check, unless the crate’s rust-version is intentionally
raised. Preserve the existing invalid-length handling.
---
Outside diff comments:
In `@crates/tauri-cli/templates/plugin/.github/workflows/clippy.yml`:
- Line 1: Update the plugin workflow templates’ dependency-install steps in
clippy.yml and test.yml to remove webkit2gtk-4.1 and install the GTK4/WebKitGTK6
development packages required by the migrated Tauri stack, including
libwebkitgtk-6.0-dev and libgtk-4-dev.
---
Minor comments:
In @.changes/android-compileroptions-dsl.md:
- Line 9: Polish the release-note wording at
.changes/android-compileroptions-dsl.md:9 to say “if your Gradle version is
earlier”; at .changes/cleanup-js-menu-channel.md:5 to use “Remove the `Channel`
used to send events to the JavaScript side when the menu is dropped”; at
.changes/fix-wix-resource-target-name.md:8 to use “Fix the WiX bundler so it
respects the resource’s target file name”; and at
.changes/resolved-command-reference-debug-assertion.md:8 to replace “can
resulting” with “can result” and clarify the affected build/runtime profiles.
In @.changes/tauri-info-skip-rust-only-js.md:
- Line 6: Update the changelog entry to describe the actual fix: prevent `tauri
info` from reporting Rust-only plugins as having a missing npm package, rather
than stating that nonexistent npm packages are reported as not installed.
In @.github/workflows/covector-version-or-publish.yml:
- Around line 73-75: Disable checkout credential persistence for every listed
actions/checkout step by adding persist-credentials: false:
.github/workflows/covector-version-or-publish.yml lines 73-75 and 22-24,
.github/workflows/check-license-header.yml line 18,
.github/workflows/covector-status.yml lines 13-15, .github/workflows/docker.yml
lines 19-20 and 62-63, and .github/workflows/fmt.yml lines 15, 28, and 41. Do
not add it only where a later step requires the checkout token to push.
In @.github/workflows/udeps.yml:
- Line 53: Update the udeps workflow path-to-matrix routing around the existing
ports/** entry so changes under ports/muda, ports/tao, ports/tray-icon, and
vendor/wayland-scanner are covered by the appropriate udeps matrix entries,
rather than only routing ports/** through wry. Preserve existing coverage while
ensuring each named vendored crate triggers udeps.
In `@crates/tauri-bundler/src/bundle.rs`:
- Around line 306-319: Update bundle_size to sum only file entries when
recursively walking directories, excluding directory entries from the total
while preserving symlink and error handling behavior for included files.
In `@crates/tauri-cli/config.schema.json`:
- Around line 617-621: Update the description for the
limitNavigationsToAppBoundDomains schema property and its source documentation
to reference the canonical src-tauri/Info.ios.plist path instead of
tauri-src/Info.ios.plist, preserving the surrounding WKAppBoundDomains guidance.
In `@crates/tauri/src/menu/plugin.rs`:
- Around line 890-892: Make MenuChannels cleanup ownership-aware in
remove_menu_channel and the corresponding new registration path: prevent a
dropped menu from removing a newer handler registered under the same MenuId.
Track the owning menu/resource or otherwise verify the stored handler belongs to
the dropping wrapper before removal, while preserving routing for the active
menu.
In `@examples/api/src/app.css`:
- Around line 54-55: Add the required empty line before the transform
declaration in the relevant app.css rule, preserving the existing --translate-x
declaration and transform behavior while satisfying Stylelint’s
declaration-empty-line-before rule.
In `@examples/api/src/views/Tray.svelte`:
- Around line 117-131: Update the “Remove tray” handler in the tray conditional
to close and reset the existing menu resource before closing and clearing tray,
reusing the cleanup behavior established by Menu.svelte’s setMenu(). Ensure each
remove/create cycle releases the prior menu instead of allowing create() to
overwrite it.
- Around line 29-50: The tray removal flow must also close and clear the
existing menu handle. Update the remove-tray logic to call menu.close() and set
menu to undefined alongside the existing tray cleanup, preventing create() from
overwriting a live native menu.
In `@examples/api/src/views/WebRTC.svelte`:
- Around line 38-40: Update the onMessage call in WebRTC.svelte to serialize
constraints with JSON.stringify(constraints) instead of implicit object
interpolation, and correct “satisified” to “satisfied” in the message text.
In `@ports/muda/.changes/config.json`:
- Around line 8-11: Update the prepublish dependency list in config.json to
install the GTK4 development package required by the crate instead of
libgtk-3-dev. Keep the existing libxdo-dev dependency and command ordering
unchanged so the publish dry-run has the required headers.
In `@ports/muda/examples/windows-common-controls-v6/src/main.rs`:
- Around line 224-233: Update the Linux/Unix GTK branch in the main window
context-menu flow to match the other examples: do not call the unavailable
ContextMenu::show_context_menu_for_gtk API, and gate or comment out this path
until GTK4 support is wired up, avoiding gtk_window() unless the required
WindowExtUnix integration is present.
In `@ports/muda/README.md`:
- Around line 33-49: Update the README dependency installation commands for the
GTK4/WebKitGTK6 port: replace GTK3 packages in the Debian/Ubuntu and FreeBSD
sections, including libgtk-3-dev and gtk3, with the appropriate GTK4 development
packages such as libgtk-4-dev and gtk4. Keep the existing installation structure
and other dependencies unchanged.
In `@ports/muda/src/builders/icon.rs`:
- Around line 115-117: Update the key accelerator handling in build so the
Result from item.set_key_accelerator is not silently discarded. Propagate the
assignment error through the existing build error path, preserving the
configured accelerator behavior and making platform-specific failures visible to
the caller.
In `@ports/muda/src/items/check.rs`:
- Around line 5-7: Correct the SPDX license identifier in the header of check.rs
from Apache-2.inner to Apache-2.0, leaving the surrounding copyright and MIT
license lines unchanged.
In `@ports/muda/src/items/predefined.rs`:
- Line 6: The ported muda item files contain mechanical “0” to “inner”
substitutions. In ports/muda/src/items/predefined.rs at lines 6 and 226-243,
replace the corrupted SPDX and test fixture/assertion strings with the correct
“Apache-2.0” and “Version: 1.0” values; make the same SPDX correction in
ports/muda/src/items/icon.rs at line 6 and ports/muda/src/items/submenu.rs at
line 6.
In `@ports/muda/src/lib.rs`:
- Around line 390-398: The documentation for the Windows-only
detach_menu_subclass_from_hwnd method incorrectly references NSView. Replace
that sentence with Windows-appropriate wording describing the hwnd as a valid
window handle, while preserving the existing safety requirement and method
behavior.
- Around line 28-42: Update the Linux dependency installation commands in the
crate documentation to match the gtk4 dependency: use gtk4 with pacman and
libgtk-4-dev with apt, while retaining the existing xdotool packages.
In `@ports/muda/src/menu.rs`:
- Around line 5-7: Correct the SPDX identifier in the license header of
ports/muda/src/menu.rs from Apache-2.inner to Apache-2.0, matching the valid
identifier used by the neighboring util.rs header.
In `@ports/muda/src/platform_impl/gtk/mod.rs`:
- Line 275: Replace the u32 GTK window key derived from window.as_ptr() with a
pointer-sized type such as usize, and update all corresponding self.instances
key declarations, lookups, inserts, and removals across init/show/hide/remove
flows to use the same type consistently.
In `@ports/tray-icon/examples/winit.rs`:
- Around line 134-140: Update the GTK initialization thread around
Application::new_tray_icon to use the GTK 4 application/main-loop pattern
instead of the unavailable gtk::main() call. Ensure the tray icon remains alive
and the GTK 4 event loop is started through the appropriate application
mechanism.
In `@ports/tray-icon/README.md`:
- Line 43: Update the FreeBSD dependency installation command in the README to
install gtk4 instead of gtk3, keeping the other packages and platform
instructions unchanged.
In `@ports/tray-icon/src/platform_impl/gtk/icon.rs`:
- Around line 46-58: Update write_to_png to store the BufWriter in a named
mutable binding rather than borrowing an unnamed temporary, then explicitly
flush it after write_image_data completes and propagate any flush error before
returning Ok. Keep the existing PNG encoding behavior unchanged.
In `@ports/tray-icon/src/platform_impl/gtk/mod.rs`:
- Around line 146-163: Update the final assertion in
temp_icon_path_preference_order to compare dir3 with
std::env::temp_dir().join("tray-icon") instead of hardcoding /tmp, preserving
the expected fallback behavior when XDG_RUNTIME_DIR is unset.
In `@ports/tray-icon/src/platform_impl/linux/icon.rs`:
- Line 20: Update the condition near the Linux icon RGBA validation to use the
modulo-based multiple-of check instead of usize::is_multiple_of, preserving the
existing invalid-length branch while remaining compatible with the crate’s Rust
1.73 MSRV.
---
Nitpick comments:
In @.github/workflows/covector-version-or-publish.yml:
- Line 26: Replace the unpinned Corepack installation at
.github/workflows/covector-version-or-publish.yml:26-26 with the repository’s
pinned toolchain, and apply the same deterministic installation at
.github/workflows/covector-version-or-publish.yml:76-76 and
.github/workflows/fmt.yml:29-29. Avoid resolving Corepack through a mutable
global npm package in all three workflow sites.
In @.github/workflows/lint-js.yml:
- Line 22: Make Corepack bootstrapping reproducible by pinning the globally
installed Corepack version or reusing the repository’s declared package-manager
setup. Apply the same change at both sites in .github/workflows/lint-js.yml
(lines 22 and 34), plus .github/workflows/publish-cli-js.yml (line 80),
.github/workflows/test-android.yml (line 46), and
.github/workflows/test-cli-js.yml (line 41).
In `@crates/tauri-bundler/src/bundle/windows/msi/mod.rs`:
- Around line 162-204: Make the directory traversal in render_wix deterministic
by iterating ResourceDirectory.directories in sorted key order, either by
changing its map type to BTreeMap or sorting the HashMap keys before rendering.
Preserve the existing recursive render_wix behavior and file ID collection
order.
In `@crates/tauri-cli/templates/mobile/android/app/build.gradle.kts`:
- Around line 59-62: Add Android compileOptions to the template’s Gradle
configuration alongside the kotlin compilerOptions block, setting Java
sourceCompatibility and targetCompatibility to Java 1.8. Match the established
configuration used by the plugin Android build template so Java and Kotlin
bytecode targets remain aligned.
In `@ports/muda/src/icon.rs`:
- Around line 116-140: Add a cfg-gated unit test in the tests module for
BadIcon::PngEncodingError, constructing it with a representative encoding error
and asserting source() returns Some. Match the existing Linux/BSD+gtk
configuration guards used by the variant and preserve the current tests
unchanged.
In `@ports/tray-icon/.changes/config.json`:
- Around line 9-10: Update the prepublish dependency commands in the changes
configuration to install the GTK4 development package required by the migrated
port, replacing the stale GTK3 package. Verify whether the ksni backend still
requires libayatana-appindicator3-dev; remove it if no longer needed, otherwise
retain it alongside the GTK4 dependency.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
.github/workflows/covector-version-or-publish.yml (2)
27-29: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winMake Corepack provisioning reproducible and integrity-controlled across CI.
The changed sites all install Corepack through a global npm command outside a lockfile. Replace these with one repository/toolchain-managed or integrity-verified bootstrap, and update sibling jobs that still use unpinned Corepack.
.github/workflows/covector-version-or-publish.yml#L27-L29: replace the ad-hoc global install inrun-integration-tests..github/workflows/covector-version-or-publish.yml#L80-L82: apply the same controlled bootstrap inversion-or-publish..github/workflows/lint-js.yml#L24-L26: apply the controlled bootstrap in the ESLint job..github/workflows/lint-js.yml#L40-L42: apply the controlled bootstrap in the TypeScript job..github/workflows/publish-cli-js.yml#L82-L84: standardize the build job with its sibling test and publish jobs..github/workflows/test-android.yml#L48-L50: apply the controlled bootstrap before Android setup..github/workflows/test-cli-js.yml#L43-L45: apply the controlled bootstrap before CLI tests.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/covector-version-or-publish.yml around lines 27 - 29, Replace the ad-hoc or unpinned Corepack installation and enablement with one repository/toolchain-managed or integrity-verified bootstrap, preserving each job’s existing setup flow. Apply this consistently in .github/workflows/covector-version-or-publish.yml at lines 27-29 and 80-82, .github/workflows/lint-js.yml at lines 24-26 and 40-42, .github/workflows/publish-cli-js.yml at lines 82-84, .github/workflows/test-android.yml at lines 48-50, and .github/workflows/test-cli-js.yml at lines 43-45.Source: Linters/SAST tools
30-32: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winPin the Node version in this job.
setup-nodehere only sets the pnpm cache; addnode-version(or a repo-wide Node version file) so integration tests don’t inherit the runner default.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/covector-version-or-publish.yml around lines 30 - 32, Update the actions/setup-node step in the workflow to explicitly select the repository’s supported Node.js version, using node-version or the established repository-wide version file. Keep the existing pnpm cache configuration unchanged so integration tests do not use the runner default.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/udeps.yml:
- Around line 145-149: Update the crate serialization used when writing
GITHUB_OUTPUT so it expands all elements of the crates Bash array rather than
only the first element. Preserve every crate appended by the matrix
conditionals, including entries from MUDA, TAO, TRAY_ICON, PORT_WRY, and
WAYLAND_SCANNER, while leaving the existing array construction unchanged.
In `@ports/muda/README.md`:
- Line 45: Update the FreeBSD dependency sentence in the README to use correct
grammar for multiple dependencies and clearly introduce the `pkg` installation
instructions.
In `@ports/tao/src/platform_impl/linux/window.rs`:
- Around line 339-359: The run_on_main_thread method must not panic when
WindowRequest::RunOnMainThread is dropped because the GTK window no longer
exists. Replace the response_rx.recv().expect(...) path with explicit
closed-channel handling, returning the API’s appropriate default, Option, or
Result value while preserving the direct current-thread execution path.
---
Nitpick comments:
In @.github/workflows/covector-version-or-publish.yml:
- Around line 27-29: Replace the ad-hoc or unpinned Corepack installation and
enablement with one repository/toolchain-managed or integrity-verified
bootstrap, preserving each job’s existing setup flow. Apply this consistently in
.github/workflows/covector-version-or-publish.yml at lines 27-29 and 80-82,
.github/workflows/lint-js.yml at lines 24-26 and 40-42,
.github/workflows/publish-cli-js.yml at lines 82-84,
.github/workflows/test-android.yml at lines 48-50, and
.github/workflows/test-cli-js.yml at lines 43-45.
- Around line 30-32: Update the actions/setup-node step in the workflow to
explicitly select the repository’s supported Node.js version, using node-version
or the established repository-wide version file. Keep the existing pnpm cache
configuration unchanged so integration tests do not use the runner default.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 6ef1c672-b722-4758-a9bf-9a6424105b9e
📒 Files selected for processing (63)
.changes/android-compileroptions-dsl.md.changes/cleanup-js-menu-channel.md.changes/fix-wix-resource-target-name.md.changes/resolved-command-reference-debug-assertion.md.changes/tauri-info-skip-rust-only-js.md.github/workflows/check-change-tags.yml.github/workflows/check-generated-files.yml.github/workflows/check-license-header.yml.github/workflows/covector-status.yml.github/workflows/covector-version-or-publish.yml.github/workflows/docker.yml.github/workflows/fmt.yml.github/workflows/lint-js.yml.github/workflows/publish-cli-js.yml.github/workflows/publish-cli-rs.yml.github/workflows/test-android.yml.github/workflows/test-cli-js.yml.github/workflows/test-cli-rs.yml.github/workflows/test-core.yml.github/workflows/udeps.ymlcrates/tauri-bundler/src/bundle.rscrates/tauri-bundler/src/bundle/windows/msi/mod.rscrates/tauri-cli/config.schema.jsoncrates/tauri-cli/templates/mobile/android/app/build.gradle.ktscrates/tauri-cli/templates/plugin/.github/workflows/clippy.ymlcrates/tauri-cli/templates/plugin/.github/workflows/test.ymlcrates/tauri-schema-generator/schemas/config.schema.jsoncrates/tauri-utils/src/config.rscrates/tauri/src/app.rscrates/tauri/src/menu/mod.rscrates/tauri/src/menu/plugin.rscrates/tauri/src/plugin.rsexamples/api/src/app.cssexamples/api/src/views/Tray.svelteexamples/api/src/views/WebRTC.svelteexamples/api/src/views/Window.svelteports/muda/.changes/config.jsonports/muda/.github/workflows/test.ymlports/muda/README.mdports/muda/examples/windows-common-controls-v6/src/main.rsports/muda/examples/wry.rsports/muda/src/icon.rsports/muda/src/items/check.rsports/muda/src/items/icon.rsports/muda/src/items/predefined.rsports/muda/src/items/submenu.rsports/muda/src/lib.rsports/muda/src/menu.rsports/muda/src/platform_impl/gtk/mod.rsports/tao/src/platform/unix.rsports/tao/src/platform_impl/linux/event_loop.rsports/tao/src/platform_impl/linux/gtk_window/imp.rsports/tao/src/platform_impl/linux/gtk_window/mod.rsports/tao/src/platform_impl/linux/window.rsports/tray-icon/.changes/config.jsonports/tray-icon/.github/workflows/clippy-fmt.ymlports/tray-icon/.github/workflows/test.ymlports/tray-icon/README.mdports/tray-icon/examples/egui.rsports/tray-icon/examples/winit.rsports/tray-icon/src/platform_impl/gtk/icon.rsports/tray-icon/src/platform_impl/gtk/mod.rsports/tray-icon/src/platform_impl/linux/icon.rs
🚧 Files skipped from review as they are similar to previous changes (43)
- .changes/android-compileroptions-dsl.md
- .github/workflows/check-license-header.yml
- .changes/tauri-info-skip-rust-only-js.md
- ports/tray-icon/.github/workflows/test.yml
- ports/tray-icon/README.md
- .github/workflows/test-cli-rs.yml
- .changes/resolved-command-reference-debug-assertion.md
- .github/workflows/check-change-tags.yml
- .changes/fix-wix-resource-target-name.md
- ports/tray-icon/.github/workflows/clippy-fmt.yml
- .github/workflows/publish-cli-rs.yml
- ports/muda/.github/workflows/test.yml
- .changes/cleanup-js-menu-channel.md
- .github/workflows/test-core.yml
- .github/workflows/covector-status.yml
- ports/tray-icon/.changes/config.json
- ports/tray-icon/src/platform_impl/gtk/icon.rs
- ports/muda/.changes/config.json
- examples/api/src/app.css
- crates/tauri-bundler/src/bundle.rs
- ports/tray-icon/examples/egui.rs
- crates/tauri-cli/config.schema.json
- ports/muda/examples/windows-common-controls-v6/src/main.rs
- ports/tray-icon/src/platform_impl/linux/icon.rs
- examples/api/src/views/Tray.svelte
- crates/tauri-utils/src/config.rs
- crates/tauri-schema-generator/schemas/config.schema.json
- ports/muda/src/items/submenu.rs
- crates/tauri-cli/templates/mobile/android/app/build.gradle.kts
- ports/tray-icon/src/platform_impl/gtk/mod.rs
- ports/muda/src/items/predefined.rs
- ports/muda/src/menu.rs
- ports/muda/src/items/check.rs
- ports/muda/src/icon.rs
- crates/tauri/src/app.rs
- crates/tauri-bundler/src/bundle/windows/msi/mod.rs
- ports/muda/examples/wry.rs
- ports/tray-icon/examples/winit.rs
- ports/muda/src/items/icon.rs
- examples/api/src/views/WebRTC.svelte
- ports/muda/src/lib.rs
- examples/api/src/views/Window.svelte
- ports/muda/src/platform_impl/gtk/mod.rs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
tauri-apps/tauri:devthrough3f62c70d6without rebasing or rewriting fork historygtk4-webkit6-tao-wrystaging work that never reacheddevquick-xmladvisories without accepting audit exceptions: vendor the released, API-compatiblewayland-scanner 0.31.10, apply Smithay's officialxml10_contentadapter fromec2d9328, and bump onlyquick-xmlto0.41as ind07c4f91wayland-cursor, Smithay Client Toolkit, WGPU, and other released consumers remain compatibleWindow: Send + Synccontract and preserve Wry callbackSend + Syncbounds across macOS/iOS constructionWhy
The earlier vendor merge reached
devbefore the follow-up GTK4/WebKitGTK 6 staging commits landed. Merging current upstream exposed cross-platform contract mismatches in the reviewed Tao/Wry work and a vulnerable build dependency in the released Wayland scanner.Pinning Smithay's full unreleased Wayland snapshot fixed
quick-xmlbut also pulled intentional breaking API/code-generation changes. This PR instead vendors the compatible scanner release and applies only Smithay's two official quick-xml update changes. All runtime Wayland crates stay on compatible crates.io releases, and no quick-xml advisory is ignored.All histories were preserved with additive commits and merge commits. No force push, rebase, or source reset was used.
Impact
Linux builds move from GTK3/WebKitGTK 4.1 to GTK4/WebKitGTK 6 and use the KSNI tray backend. Navigation, IPC, page-load, and document-title callbacks require
Syncin addition toSend; this is recorded as a breaking change fortauriandtauri-runtime.The four standalone port lockfiles now point to the final published sibling branch tips and resolve
quick-xml 0.41.0.Validation
cargo clippy --target x86_64-unknown-linux-gnu --all-targets --all-features --locked -- -D warningsWindow/EventLoopProxySend/Sync tests (4 passed)cargo test -p tauri-runtime-wry --all-features --lib --lockedcargo test -p tauri --all-features --lib --locked(60 passed)cargo auditfor root, Muda, Tao, Tray Icon, and Wry (0 vulnerabilities in all five)cargo fmt --all -- --checkpnpm install --frozen-lockfile, formatting, ESLint, and TypeScript checksactionlintgit diff --checkandgit fsck --connectivity-only --no-danglingSummary by CodeRabbit
compilerOptionsDSL, including updated Android build guidance).tauri infono longer reports Rust-only plugins as missing npm packages.Send + Sync.