No fix can be taken until Tauri moves to GTK 4 (glib 0.18 comes in through gtk 0.18, the last gtk3-rs release). Both alerts are dismissed as tolerable risk, and security updates no longer open issues for upgrades they cannot make (bab3a474, dae1f7e8).
Upgrade glib to 0.20.0: needs code changes #128
Closed as not plannedg1tbot opened this dependenciessecurity
glib (crates.io) has known vulnerabilities with a fix in 0.20.0, and raising its version alone does not pass this project's checks. Upgrade it to 0.20.0 or later everywhere it is locked, and change the code that depends on it, keeping other changes to what the upgrade needs.
| Advisory | Severity | Affected | Fixed in | Summary |
|---|---|---|---|---|
| GHSA-wrw7-89jp-8q8g | medium | 0.18.5 | 0.20.0 | Unsoundness in Iterator and DoubleEndedIterator impls for glib::VariantStrIter |
Locked in: .
If the fix needs a major upgrade that breaks the build, change the code that depends on it in the same pull request.
Definition of done
- No lockfile resolves a vulnerable version, and the tests still pass.
Opened by g1t's security updates. Turn them off for this project on its Security page.