From 2393188deac907725e42e834f9961e2a072e8e0c Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 19 Sep 2026 22:23:23 -0300 Subject: [PATCH] publish new versions (#3591) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- .changes/http-redirect-scope.md | 19 --------- .changes/log-webview-double-colon.md | 6 --- .changes/single-instance-foreground-rights.md | 5 --- .changes/updater-allow-downgrades-config.md | 20 ---------- .changes/updater-require-signed-version.md | 23 ----------- Cargo.lock | 10 ++--- examples/api/CHANGELOG.md | 7 ++++ examples/api/package.json | 2 +- examples/api/src-tauri/CHANGELOG.md | 8 ++++ examples/api/src-tauri/Cargo.toml | 8 ++-- plugins/http/CHANGELOG.md | 18 +++++++++ plugins/http/Cargo.toml | 2 +- plugins/log/CHANGELOG.md | 4 ++ plugins/log/Cargo.toml | 2 +- plugins/log/package.json | 2 +- plugins/single-instance/CHANGELOG.md | 4 ++ plugins/single-instance/Cargo.toml | 2 +- plugins/updater/CHANGELOG.md | 40 +++++++++++++++++++ plugins/updater/Cargo.toml | 2 +- plugins/updater/package.json | 2 +- 20 files changed, 97 insertions(+), 89 deletions(-) delete mode 100644 .changes/http-redirect-scope.md delete mode 100644 .changes/log-webview-double-colon.md delete mode 100644 .changes/single-instance-foreground-rights.md delete mode 100644 .changes/updater-allow-downgrades-config.md delete mode 100644 .changes/updater-require-signed-version.md diff --git a/.changes/http-redirect-scope.md b/.changes/http-redirect-scope.md deleted file mode 100644 index 58e4616c1..000000000 --- a/.changes/http-redirect-scope.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -"http": minor ---- - -**Security:** Added the `scopeRedirects` plugin configuration option, which checks the URL scope on every hop of a redirect chain instead of only on the URL requested by the frontend. Without it, a server on an allowed origin can redirect the request to any other origin - including `localhost` services, internal hosts and cloud metadata endpoints - and the plugin follows it, returning the response to the webview. - -```json -{ - "plugins": { - "http": { - "scopeRedirects": true - } - } -} -``` - -It is opt-in because a redirect to a URL that is not allowed by the scope now fails with `url not allowed on the configured scope` instead of being followed, so applications that rely on being redirected outside of their scope must add the redirect target to the scope. **This will become the default in v3.** - -Note that `tauri_plugin_http::init()` now returns `TauriPlugin>` instead of `TauriPlugin`. diff --git a/.changes/log-webview-double-colon.md b/.changes/log-webview-double-colon.md deleted file mode 100644 index f59bf1b52..000000000 --- a/.changes/log-webview-double-colon.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"log": patch -"log-js": patch ---- - -Log webview log target locations after 2 colons instead of 1. (e.g. `webview:myFunction@http://localhost:5173/src/myFile.ts?t=1787480723620:47:4` to `webview::myFunction@http://localhost:5173/src/myFile.ts?t=1787480723620:47:4`) diff --git a/.changes/single-instance-foreground-rights.md b/.changes/single-instance-foreground-rights.md deleted file mode 100644 index 57794e69b..000000000 --- a/.changes/single-instance-foreground-rights.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"single-instance": patch ---- - -On Windows, the second instance now allows the first instance to bring its window to the front before exiting, so focusing a window from the callback no longer gets refused by Windows. diff --git a/.changes/updater-allow-downgrades-config.md b/.changes/updater-allow-downgrades-config.md deleted file mode 100644 index 365cd956c..000000000 --- a/.changes/updater-allow-downgrades-config.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -"updater": minor -"updater-js": minor ---- - -**Breaking change:** the `allowDowngrades` option was removed from the `check` command and is now read from the plugin configuration instead. - -Previously any code running in the webview could pass `allowDowngrades: true` to `plugin:updater|check` and relax the version check from "the update must be newer" to "the update must be different", overriding the comparator the application had configured on the Rust side. The flag is now an application-level setting: - -```json -{ - "plugins": { - "updater": { - "allowDowngrades": true - } - } -} -``` - -It defaults to `false`, and is ignored when the application provides its own `Builder::default_version_comparator`, which continues to take precedence. diff --git a/.changes/updater-require-signed-version.md b/.changes/updater-require-signed-version.md deleted file mode 100644 index be0e47d77..000000000 --- a/.changes/updater-require-signed-version.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -"updater": minor ---- - -Add a `requireSignedVersion` configuration option that binds an update to the version it was signed for. - -The update endpoint response is fetched over TLS but is not itself signed, and the signature only covers the downloaded artifact. Anyone able to serve a crafted response could therefore pair an inflated `version` field with the `url` and `signature` of an older release and force a downgrade to a genuine but outdated build, because that older artifact carries a valid signature. - -The Tauri CLI records the version in the signature's trusted comment, which the signature covers. With this option enabled the updater compares that signed version against the one announced by the endpoint and rejects the update when they differ: - -```json -{ - "plugins": { - "updater": { - "requireSignedVersion": true - } - } -} -``` - -It defaults to `false` because releases signed before the CLI started recording the version carry none and would be rejected. Re-sign and re-publish every release your users can still update from before enabling it, otherwise an older signature can still be served to bypass the check. When the signature does carry a version, a mismatch is rejected whether or not the option is enabled. - -This is checked independently of `allowDowngrades`: it constrains which artifact a given version number may resolve to, not whether that version is newer than the running one. diff --git a/Cargo.lock b/Cargo.lock index 67d7e8a7a..9ede4439e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -207,7 +207,7 @@ checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3" [[package]] name = "api" -version = "2.0.48" +version = "2.0.49" dependencies = [ "log", "serde", @@ -6605,7 +6605,7 @@ dependencies = [ [[package]] name = "tauri-plugin-http" -version = "2.6.1" +version = "2.7.0" dependencies = [ "bytes", "cookie_store", @@ -6641,7 +6641,7 @@ dependencies = [ [[package]] name = "tauri-plugin-log" -version = "2.9.1" +version = "2.9.2" dependencies = [ "android_logger", "fern", @@ -6783,7 +6783,7 @@ dependencies = [ [[package]] name = "tauri-plugin-single-instance" -version = "2.4.4" +version = "2.4.5" dependencies = [ "semver", "serde", @@ -6853,7 +6853,7 @@ dependencies = [ [[package]] name = "tauri-plugin-updater" -version = "2.11.0" +version = "2.12.0" dependencies = [ "base64 0.22.1", "dirs 6.0.0", diff --git a/examples/api/CHANGELOG.md b/examples/api/CHANGELOG.md index 70baa50b6..77b1396aa 100644 --- a/examples/api/CHANGELOG.md +++ b/examples/api/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [2.0.45] + +### Dependencies + +- Upgraded to `log-js@2.9.2` +- Upgraded to `updater-js@2.12.0` + ## [2.0.44] ### Dependencies diff --git a/examples/api/package.json b/examples/api/package.json index 81cac8b9a..98ed4b6ab 100644 --- a/examples/api/package.json +++ b/examples/api/package.json @@ -1,7 +1,7 @@ { "name": "api", "private": true, - "version": "2.0.44", + "version": "2.0.45", "type": "module", "scripts": { "dev": "vite --clearScreen false", diff --git a/examples/api/src-tauri/CHANGELOG.md b/examples/api/src-tauri/CHANGELOG.md index 1d6def5a3..cb78a36e2 100644 --- a/examples/api/src-tauri/CHANGELOG.md +++ b/examples/api/src-tauri/CHANGELOG.md @@ -1,5 +1,13 @@ # Changelog +## [2.0.49] + +### Dependencies + +- Upgraded to `http@2.7.0` +- Upgraded to `log@2.9.2` +- Upgraded to `updater@2.12.0` + ## [2.0.48] ### Dependencies diff --git a/examples/api/src-tauri/Cargo.toml b/examples/api/src-tauri/Cargo.toml index e9c963870..dc15465c3 100644 --- a/examples/api/src-tauri/Cargo.toml +++ b/examples/api/src-tauri/Cargo.toml @@ -1,7 +1,7 @@ [package] name = "api" publish = false -version = "2.0.48" +version = "2.0.49" description = "An example Tauri Application showcasing the api" edition = "2021" rust-version = { workspace = true } @@ -20,7 +20,7 @@ serde = { workspace = true } tiny_http = "0.12" time = "0.3" log = { workspace = true } -tauri-plugin-log = { path = "../../../plugins/log", version = "2.9.1" } +tauri-plugin-log = { path = "../../../plugins/log", version = "2.9.2" } tauri-plugin-fs = { path = "../../../plugins/fs", version = "2.5.2", features = [ "watch", ] } @@ -29,7 +29,7 @@ tauri-plugin-dialog = { path = "../../../plugins/dialog", version = "2.7.3" } tauri-plugin-http = { path = "../../../plugins/http", features = [ "multipart", "cookies", -], version = "2.6.1" } +], version = "2.7.0" } tauri-plugin-notification = { path = "../../../plugins/notification", version = "2.4.0", features = [ "windows7-compat", ] } @@ -57,7 +57,7 @@ features = [ [target."cfg(any(target_os = \"macos\", windows, target_os = \"linux\", target_os = \"dragonfly\", target_os = \"freebsd\", target_os = \"openbsd\", target_os = \"netbsd\"))".dependencies] tauri-plugin-cli = { path = "../../../plugins/cli", version = "2.4.1" } tauri-plugin-global-shortcut = { path = "../../../plugins/global-shortcut", version = "2.3.2" } -tauri-plugin-updater = { path = "../../../plugins/updater", version = "2.11.0" } +tauri-plugin-updater = { path = "../../../plugins/updater", version = "2.12.0" } tauri-plugin-window-state = { path = "../../../plugins/window-state", version = "2.2.0" } [target."cfg(any(target_os = \"android\", target_os = \"ios\"))".dependencies] diff --git a/plugins/http/CHANGELOG.md b/plugins/http/CHANGELOG.md index b4f3d8c01..ed6b948ac 100644 --- a/plugins/http/CHANGELOG.md +++ b/plugins/http/CHANGELOG.md @@ -1,5 +1,23 @@ # Changelog +## [2.7.0] + +- [`1198a524`](https://github.com/tauri-apps/plugins-workspace/commit/1198a524b710abf2abeb1d9bd7b252402d26ca6d) **Security:** Added the `scopeRedirects` plugin configuration option, which checks the URL scope on every hop of a redirect chain instead of only on the URL requested by the frontend. Without it, a server on an allowed origin can redirect the request to any other origin - including `localhost` services, internal hosts and cloud metadata endpoints - and the plugin follows it, returning the response to the webview. + + ```json + { + "plugins": { + "http": { + "scopeRedirects": true + } + } + } + ``` + + It is opt-in because a redirect to a URL that is not allowed by the scope now fails with `url not allowed on the configured scope` instead of being followed, so applications that rely on being redirected outside of their scope must add the redirect target to the scope. **This will become the default in v3.** + + Note that `tauri_plugin_http::init()` now returns `TauriPlugin>` instead of `TauriPlugin`. + ## [2.6.1] - [`a21555dd`](https://github.com/tauri-apps/plugins-workspace/commit/a21555ddd2eaadfed23848912fe2802c2ba7579e) ([#3566](https://github.com/tauri-apps/plugins-workspace/pull/3566) by [@followdarko](https://github.com/tauri-apps/plugins-workspace/../../followdarko)) Fix unhandled promise rejections on every `fetch` teardown: the request/body cleanup commands were fired as floating promises, and releasing an already-released resource rejects with `The resource id N is invalid.`. `dropBody` is now idempotent and both cleanup calls handle their own rejection. diff --git a/plugins/http/Cargo.toml b/plugins/http/Cargo.toml index 6c707f4d2..f0eeadd3f 100644 --- a/plugins/http/Cargo.toml +++ b/plugins/http/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "tauri-plugin-http" -version = "2.6.1" +version = "2.7.0" description = "Access an HTTP client written in Rust." edition = { workspace = true } authors = { workspace = true } diff --git a/plugins/log/CHANGELOG.md b/plugins/log/CHANGELOG.md index abf71431e..11aea9e12 100644 --- a/plugins/log/CHANGELOG.md +++ b/plugins/log/CHANGELOG.md @@ -1,5 +1,9 @@ # Changelog +## [2.9.2] + +- [`2df3d936`](https://github.com/tauri-apps/plugins-workspace/commit/2df3d9368187e1d2ce736d3e0b2d4bdcae35b011) ([#3574](https://github.com/tauri-apps/plugins-workspace/pull/3574)) Log webview log target locations after 2 colons instead of 1. (e.g. `webview:myFunction@http://localhost:5173/src/myFile.ts?t=1787480723620:47:4` to `webview::myFunction@http://localhost:5173/src/myFile.ts?t=1787480723620:47:4`) + ## [2.9.1] - [`f8053e65`](https://github.com/tauri-apps/plugins-workspace/commit/f8053e659e4ccd85c1f52833411ff8417cbc5e69) ([#3527](https://github.com/tauri-apps/plugins-workspace/pull/3527) by [@Legend-Master](https://github.com/tauri-apps/plugins-workspace/../../Legend-Master)) Documented Cargo feature flags in each plugin's crate-level documentation. diff --git a/plugins/log/Cargo.toml b/plugins/log/Cargo.toml index bd655a0ae..1bf62bb18 100644 --- a/plugins/log/Cargo.toml +++ b/plugins/log/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "tauri-plugin-log" -version = "2.9.1" +version = "2.9.2" description = "Configurable logging for your Tauri app." authors = { workspace = true } license = { workspace = true } diff --git a/plugins/log/package.json b/plugins/log/package.json index bb2db12e8..b21ff6cec 100644 --- a/plugins/log/package.json +++ b/plugins/log/package.json @@ -1,6 +1,6 @@ { "name": "@tauri-apps/plugin-log", - "version": "2.9.1", + "version": "2.9.2", "description": "Configurable logging for your Tauri app.", "license": "MIT OR Apache-2.0", "authors": [ diff --git a/plugins/single-instance/CHANGELOG.md b/plugins/single-instance/CHANGELOG.md index c2bb43881..3e4c94aab 100644 --- a/plugins/single-instance/CHANGELOG.md +++ b/plugins/single-instance/CHANGELOG.md @@ -1,5 +1,9 @@ # Changelog +## [2.4.5] + +- [`67cd25a1`](https://github.com/tauri-apps/plugins-workspace/commit/67cd25a10ce3deb1b935e725228e528766f24ad7) ([#3592](https://github.com/tauri-apps/plugins-workspace/pull/3592)) On Windows, the second instance now allows the first instance to bring its window to the front before exiting, so focusing a window from the callback no longer gets refused by Windows. + ## [2.4.4] - [`f8053e65`](https://github.com/tauri-apps/plugins-workspace/commit/f8053e659e4ccd85c1f52833411ff8417cbc5e69) ([#3527](https://github.com/tauri-apps/plugins-workspace/pull/3527) by [@Legend-Master](https://github.com/tauri-apps/plugins-workspace/../../Legend-Master)) Documented Cargo feature flags in each plugin's crate-level documentation. diff --git a/plugins/single-instance/Cargo.toml b/plugins/single-instance/Cargo.toml index 9e3404743..e636a7f57 100644 --- a/plugins/single-instance/Cargo.toml +++ b/plugins/single-instance/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "tauri-plugin-single-instance" -version = "2.4.4" +version = "2.4.5" description = "Ensure a single instance of your tauri app is running." authors = { workspace = true } license = { workspace = true } diff --git a/plugins/updater/CHANGELOG.md b/plugins/updater/CHANGELOG.md index 9527f65d3..6a5484a8b 100644 --- a/plugins/updater/CHANGELOG.md +++ b/plugins/updater/CHANGELOG.md @@ -1,5 +1,23 @@ # Changelog +## [2.12.0] + +- [`1308bfa3`](https://github.com/tauri-apps/plugins-workspace/commit/1308bfa399b962b3977c767100a6339d1cbfdd20) **Breaking change:** the `allowDowngrades` option was removed from the `check` command and is now read from the plugin configuration instead. + + Previously any code running in the webview could pass `allowDowngrades: true` to `plugin:updater|check` and relax the version check from "the update must be newer" to "the update must be different", overriding the comparator the application had configured on the Rust side. The flag is now an application-level setting: + + ```json + { + "plugins": { + "updater": { + "allowDowngrades": true + } + } + } + ``` + + It defaults to `false`, and is ignored when the application provides its own `Builder::default_version_comparator`, which continues to take precedence. + ## [2.11.0] - [`f8053e65`](https://github.com/tauri-apps/plugins-workspace/commit/f8053e659e4ccd85c1f52833411ff8417cbc5e69) ([#3527](https://github.com/tauri-apps/plugins-workspace/pull/3527) by [@Legend-Master](https://github.com/tauri-apps/plugins-workspace/../../Legend-Master)) Documented Cargo feature flags in each plugin's crate-level documentation. @@ -215,3 +233,25 @@ ## \[2.0.0-alpha.0] - [`717ae67`](https://github.com/tauri-apps/plugins-workspace/commit/717ae670978feb4492fac1f295998b93f2b9347f)([#371](https://github.com/tauri-apps/plugins-workspace/pull/371)) First v2 alpha release! +7c2f9e0ce4c75c07ffa3fd76391a25b58f5daf)([#802](https://github.com/tauri-apps/plugins-workspace/pull/802)) Update to @tauri-apps/api v2.0.0-alpha.12. + +## \[2.0.0-alpha.3] + +- [`e438e0a`](https://github.com/tauri-apps/plugins-workspace/commit/e438e0a62d4b430a5159f05f13ecd397dd891a0d)([#676](https://github.com/tauri-apps/plugins-workspace/pull/676)) Update to @tauri-apps/api v2.0.0-alpha.11. + +## \[2.0.0-alpha.2] + +- [`5c13736`](https://github.com/tauri-apps/plugins-workspace/commit/5c137365c60790e8d4037d449e8237aa3fffdab0)([#673](https://github.com/tauri-apps/plugins-workspace/pull/673)) Update to @tauri-apps/api v2.0.0-alpha.9. + +## \[2.0.0-alpha.2] + +- [`4e2cef9`](https://github.com/tauri-apps/plugins-workspace/commit/4e2cef9b702bbbb9cf4ee17de50791cb21f1b2a4)([#593](https://github.com/tauri-apps/plugins-workspace/pull/593)) Update to alpha.12. + +## \[2.0.0-alpha.1] + +- [`d74fc0a`](https://github.com/tauri-apps/plugins-workspace/commit/d74fc0a097996e90a37be8f57d50b7d1f6ca616f)([#555](https://github.com/tauri-apps/plugins-workspace/pull/555)) Update to alpha.11. +- [`4ab90f0`](https://github.com/tauri-apps/plugins-workspace/commit/4ab90f048eab2918344f97dc8e04413a404e392d)([#431](https://github.com/tauri-apps/plugins-workspace/pull/431)) The updater plugin is recieving a few changes to improve consistency and ergonomics of the Rust and JS APIs + +## \[2.0.0-alpha.0] + +- [`717ae67`](https://github.com/tauri-apps/plugins-workspace/commit/717ae670978feb4492fac1f295998b93f2b9347f)([#371](https://github.com/tauri-apps/plugins-workspace/pull/371)) First v2 alpha release! diff --git a/plugins/updater/Cargo.toml b/plugins/updater/Cargo.toml index 4ca645e92..01d777aa9 100644 --- a/plugins/updater/Cargo.toml +++ b/plugins/updater/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "tauri-plugin-updater" -version = "2.11.0" +version = "2.12.0" description = "In-app updates for Tauri applications." edition = { workspace = true } authors = { workspace = true } diff --git a/plugins/updater/package.json b/plugins/updater/package.json index 44547c299..820b3a1b6 100644 --- a/plugins/updater/package.json +++ b/plugins/updater/package.json @@ -1,6 +1,6 @@ { "name": "@tauri-apps/plugin-updater", - "version": "2.11.0", + "version": "2.12.0", "license": "MIT OR Apache-2.0", "authors": [ "Tauri Programme within The Commons Conservancy"