Patch Tauri origin confusion advisory

[AnthonyRonning]

Summary

• bump Rust tauri from 2.10.3 to patched 2.11.1 for GHSA-7gmj-67g7-phm9 / CVE-2026-42184
• align direct tauri-build dependency with Cargo's resolved 2.6.2
• update Cargo.lock via Cargo; this brings the required Tauri internals forward, including tauri-runtime, tauri-utils, wry, tao, muda, and tray-icon

Scope

This intentionally does not update the JS @tauri-apps packages or the CI cargo-tauri CLI pin. The advisory is for the Rust cargo tauri package, and local checks pass with the current JS/CLI versions.

Notes

• The advisory affects Android and Windows origin classification. We do not ship Windows, but Android is relevant.
• The existing phf_generator rand workaround is still needed because kuchikiki/selectors 0.24 remains in the graph, though the lockfile no longer contains rand 0.7.3.

Checks

• cargo metadata --locked --offline --format-version 1 --manifest-path frontend/src-tauri/Cargo.toml --no-deps
• cargo check --locked --manifest-path frontend/src-tauri/Cargo.toml
• cargo test --locked --manifest-path frontend/src-tauri/Cargo.toml --all-targets
• bun run build
• bun test
• pre-commit hook passed

Source: GHSA-7gmj-67g7-phm9

---

Summary by CodeRabbit

• Chores
  • Upgraded Tauri toolchain and related packages to the 2.11.x series across the project.
  • Pinned frontend Tauri packages and CLI to matching 2.11.x versions for consistency.
  • Updated CI and release workflows to require and install Tauri CLI 2.11.1 during builds and PRs.
  • Removed a temporary vendored/patch workaround for a transitive dependency advisory.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 780980fc-7cd3-45bb-a4ab-a0bfab94fd3f

📥 Commits

Reviewing files that changed from the base of the PR and between cc136b7 and 0769d92.

⛔ Files ignored due to path filters (2)

• frontend/bun.lock is excluded by !**/*.lock
• frontend/src-tauri/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (13)

• .github/workflows/android-build.yml
• .github/workflows/android-pr-build.yml
• .github/workflows/desktop-build.yml
• .github/workflows/desktop-pr-build.yml
• .github/workflows/mobile-build.yml
• .github/workflows/mobile-pr-build.yml
• .github/workflows/release.yml
• frontend/package.json
• frontend/src-tauri/Cargo.toml
• frontend/src-tauri/vendor/phf_generator-0.8.0/.gitignore
• frontend/src-tauri/vendor/phf_generator-0.8.0/Cargo.toml
• frontend/src-tauri/vendor/phf_generator-0.8.0/README.md
• frontend/src-tauri/vendor/phf_generator-0.8.0/src/lib.rs

💤 Files with no reviewable changes (4)

• frontend/src-tauri/vendor/phf_generator-0.8.0/.gitignore
• frontend/src-tauri/vendor/phf_generator-0.8.0/Cargo.toml
• frontend/src-tauri/vendor/phf_generator-0.8.0/README.md
• frontend/src-tauri/vendor/phf_generator-0.8.0/src/lib.rs

✅ Files skipped from review due to trivial changes (4)

• .github/workflows/mobile-pr-build.yml
• .github/workflows/desktop-build.yml
• .github/workflows/mobile-build.yml
• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

Bumps frontend Tauri crates and JS pins (tauri-build 2.5.6→2.6.2, tauri 2.10.3→2.11.2, @tauri-apps/* to 2.11.x), removes the temporary phf_generator patch/advisory, and updates GitHub Actions cache keys and REQUIRED_TAURI_CLI_VERSION to tauri-cli 2.11.1 across CI workflows.

Changes

Tauri Ecosystem Dependencies

Layer / File(s)	Summary
Tauri dependency upgrades frontend/src-tauri/Cargo.toml, frontend/package.json	tauri-build bumped to 2.6.2; tauri bumped to 2.11.2; JS packages pinned (@tauri-apps/api→2.11.0, @tauri-apps/cli→2.11.1) and several @tauri-apps/* plugins bumped. The temporary [patch.crates-io] vendored phf_generator override and its advisory README/code were removed.
CI workflow tauri-cli pinning .github/workflows/*	Cache keys and REQUIRED_TAURI_CLI_VERSION updated to reference tauri-cli 2.11.1 in Android, desktop, mobile, PR, and release workflows; Android PR build command trailing true argument removed.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• OpenSecretCloud/Maple#526: Related updates to GitHub Actions logic that conditionally installs the Tauri CLI and pins required versions.
• OpenSecretCloud/Maple#278: Prior CI workflow changes touching tauri-cli install/version gating.
• OpenSecretCloud/Maple#296: Overlaps on Tauri dependency and tauri-cli version pin updates.

Poem

🐰 I hopped through manifests, neat and spry,
Pinned CLI, bumped crates beneath the sky,
Cargo and package locks align,
CI restores the tauri line,
A tiny hop, the build runs spry.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly describes the main objective: patching a Tauri security advisory. It clearly identifies the specific change across all modified files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch patch-tauri-origin-confusion

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cloudflare-workers-and-pages]

Deploying maple with Cloudflare Pages

Latest commit:	0769d92
Status:	✅ Deploy successful!
Preview URL:	https://d3954649.maple-ca8.pages.dev
Branch Preview URL:	https://patch-tauri-origin-confusion.maple-ca8.pages.dev

View logs

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.