fix: npm audit (#11243)

the audit failed, so the 2.0.2 release is failing. I'm also adding the latest merged change to the 2.0.2 release in this change so we're in sync in the changelog.

.github/workflows/supply-chain.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Install Rust
         run: rustup update stable && rustup default stable
 
-      - uses: actions/cache@v2
+      - uses: actions/cache@v4
         with:
           path: ${{ runner.tool_cache }}/cargo-vet
           key: cargo-vet-bin-${{ env.CARGO_VET_VERSION }}

Cargo.lock

@@ -1473,9 +1473,9 @@ dependencies = [
 
 [[package]]
 name = "cargo-mobile2"
-version = "0.17.2"
+version = "0.17.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4200047e17fd50597ae9ee15657b0c53105394f95d3a1aa82148dba35acb412"
+checksum = "5c8052fc43184dc6c572437c2f8dae83e4ca9a5b27c790e269b90b080c1b9301"
 dependencies = [
  "colored",
  "core-foundation 0.10.0",
@@ -8697,7 +8697,7 @@ checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
 
 [[package]]
 name = "tauri"
-version = "2.0.1"
+version = "2.0.2"
 dependencies = [
  "anyhow",
  "bytes",
@@ -8779,7 +8779,7 @@ dependencies = [
 
 [[package]]
 name = "tauri-bundler"
-version = "2.0.1"
+version = "2.0.2"
 dependencies = [
  "anyhow",
  "ar",
@@ -8823,7 +8823,7 @@ dependencies = [
 
 [[package]]
 name = "tauri-cli"
-version = "2.0.1"
+version = "2.0.2"
 dependencies = [
  "anyhow",
  "ar",

crates/tauri-bundler/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## \[2.0.2]
+
+### Bug Fixes
+
+- [`858b3516a`](https://www.github.com/tauri-apps/tauri/commit/858b3516a008ae5e6f2af489805896e2c142be10) ([#11217](https://www.github.com/tauri-apps/tauri/pull/11217) by [@kittuov](https://www.github.com/tauri-apps/tauri/../../kittuov)) On Windows, fixed command arguments for `bundle -> windows -> msi -> elevatedUpdateTask`. to work with spaces in `productName`
+- [`a49a19ffa`](https://www.github.com/tauri-apps/tauri/commit/a49a19ffa304f031fb1a04d31a567cc7f42a380a) ([#11218](https://www.github.com/tauri-apps/tauri/pull/11218)) Fix bundling `appimage`, `deb` and `rpm` bundles failing to open when using `mainBinaryName` with spaces.
+
 ## \[2.0.1]
 
 ### What's Changed

crates/tauri-bundler/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tauri-bundler"
-version = "2.0.1"
+version = "2.0.2"
 authors = [
   "George Burton <burtonageo@gmail.com>",
   "Tauri Programme within The Commons Conservancy",

crates/tauri-bundler/src/bundle/linux/appimage/mod.rs

@@ -15,7 +15,7 @@ use anyhow::Context;
 use handlebars::Handlebars;
 use std::{
   collections::BTreeMap,
-  fs::{remove_dir_all, write},
+  fs,
   path::PathBuf,
   process::{Command, Stdio},
 };
@@ -38,17 +38,32 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {
   };
   let package_dir = settings.project_out_directory().join("bundle/appimage_deb");
 
+  let main_binary = settings.main_binary()?;
+
+  let mut settings = settings.clone();
+  if main_binary.name().contains(" ") {
+    let main_binary_path = settings.binary_path(main_binary);
+    let project_out_directory = settings.project_out_directory();
+
+    let main_binary_name_kebab = heck::AsKebabCase(main_binary.name()).to_string();
+    let new_path = project_out_directory.join(&main_binary_name_kebab);
+    fs::copy(main_binary_path, new_path)?;
+
+    let main_binary = settings.main_binary_mut()?;
+    main_binary.set_name(main_binary_name_kebab);
+  }
+
   // generate deb_folder structure
-  let (data_dir, icons) = debian::generate_data(settings, &package_dir)
+  let (data_dir, icons) = debian::generate_data(&settings, &package_dir)
     .with_context(|| "Failed to build data folders and files")?;
   common::copy_custom_files(&settings.appimage().files, &data_dir)
     .with_context(|| "Failed to copy custom files")?;
 
   let output_path = settings.project_out_directory().join("bundle/appimage");
   if output_path.exists() {
-    remove_dir_all(&output_path)?;
+    fs::remove_dir_all(&output_path)?;
   }
-  std::fs::create_dir_all(output_path.clone())?;
+  fs::create_dir_all(output_path.clone())?;
   let app_dir_path = output_path.join(format!("{}.AppDir", settings.product_name()));
   let appimage_filename = format!(
     "{}_{}_{}.AppImage",
@@ -101,7 +116,7 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {
 
   log::info!(action = "Bundling"; "{} ({})", appimage_filename, appimage_path.display());
 
-  write(&sh_file, temp)?;
+  fs::write(&sh_file, temp)?;
 
   // chmod script for execution
   Command::new("chmod")
@@ -119,6 +134,6 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {
     .output_ok()
     .context("error running build_appimage.sh")?;
 
-  remove_dir_all(&package_dir)?;
+  fs::remove_dir_all(&package_dir)?;
   Ok(vec![appimage_path])
 }

crates/tauri-bundler/src/bundle/linux/freedesktop/mod.rs

@@ -99,6 +99,7 @@ pub fn generate_desktop_file(
   data_dir: &Path,
 ) -> crate::Result<(PathBuf, PathBuf)> {
   let bin_name = settings.main_binary_name()?;
+
   let product_name = settings.product_name();
   let desktop_file_name = format!("{product_name}.desktop");
   let path = PathBuf::from("usr/share/applications").join(desktop_file_name);
@@ -150,6 +151,12 @@ pub fn generate_desktop_file(
 
   let mime_type = (!mime_type.is_empty()).then_some(mime_type.join(";"));
 
+  let bin_name_exec = if bin_name.contains(" ") {
+    format!("\"{bin_name}\"")
+  } else {
+    bin_name.to_string()
+  };
+
   handlebars.render_to_write(
     "main.desktop",
     &DesktopTemplateParams {
@@ -162,7 +169,7 @@ pub fn generate_desktop_file(
       } else {
         None
       },
-      exec: bin_name,
+      exec: &bin_name_exec,
       icon: bin_name,
       name: settings.product_name(),
       mime_type,

crates/tauri-bundler/src/bundle/settings.rs

@@ -889,6 +889,16 @@ impl Settings {
       .map_err(Into::into)
   }
 
+  /// Returns the file name of the binary being bundled.
+  pub fn main_binary_mut(&mut self) -> crate::Result<&mut BundleBinary> {
+    self
+      .binaries
+      .iter_mut()
+      .find(|bin| bin.main)
+      .context("failed to find main binary, make sure you have a `package > default-run` in the Cargo.toml file")
+      .map_err(Into::into)
+  }
+
   /// Returns the file name of the binary being bundled.
   pub fn main_binary_name(&self) -> crate::Result<&str> {
     self

crates/tauri-bundler/src/bundle/windows/msi/update-task.xml

@@ -37,7 +37,7 @@
   <Actions Context="Author">
     <Exec>
       <Command>cmd.exe</Command>
-      <Arguments>/c "%SYSTEMROOT%\System32\msiexec.exe /i %TEMP%\\{{product_name}}.msi {{msiexec_args}} /promptrestart"</Arguments>
+      <Arguments>/c ^"%SYSTEMROOT%\System32\msiexec.exe /i "%TEMP%\\{{product_name}}.msi" {{msiexec_args}} /promptrestart^"</Arguments>
     </Exec>
   </Actions>
 </Task>

crates/tauri-cli/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## \[2.0.2]
+
+### What's Changed
+
+- [`4475fbb50`](https://www.github.com/tauri-apps/tauri/commit/4475fbb502c5ffb3cea4de6bef1c7869be39bed6) ([#11208](https://www.github.com/tauri-apps/tauri/pull/11208) by [@lucasfernog](https://www.github.com/tauri-apps/tauri/../../lucasfernog)) Update cargo-mobile2 to 0.17.3, fixing lib name validation.
+- [`a49a19ffa`](https://www.github.com/tauri-apps/tauri/commit/a49a19ffa304f031fb1a04d31a567cc7f42a380a) ([#11218](https://www.github.com/tauri-apps/tauri/pull/11218)) Fix bundling `appimage`, `deb` and `rpm` bundles failing to open when using `mainBinaryName` with spaces.
+
+### Dependencies
+
+- Upgraded to `tauri-bundler@2.0.2`
+
 ## \[2.0.1]
 
 ### What's Changed

crates/tauri-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tauri-cli"
-version = "2.0.1"
+version = "2.0.2"
 authors = ["Tauri Programme within The Commons Conservancy"]
 edition = "2021"
 rust-version = "1.77.2"
@@ -36,7 +36,7 @@ name = "cargo-tauri"
 path = "src/main.rs"
 
 [target."cfg(any(target_os = \"linux\", target_os = \"dragonfly\", target_os = \"freebsd\", target_os = \"openbsd\", target_os = \"netbsd\", target_os = \"windows\", target_os = \"macos\"))".dependencies]
-cargo-mobile2 = { version = "0.17.2", default-features = false }
+cargo-mobile2 = { version = "0.17.3", default-features = false }
 
 [dependencies]
 jsonrpsee = { version = "0.24.5", features = ["server"] }
@@ -47,7 +47,7 @@ sublime_fuzzy = "0.7"
 clap_complete = "4"
 clap = { version = "4.5", features = ["derive", "env"] }
 anyhow = "1.0"
-tauri-bundler = { version = "2.0.1", default-features = false, path = "../tauri-bundler" }
+tauri-bundler = { version = "2.0.2", default-features = false, path = "../tauri-bundler" }
 colored = "2.1"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = { version = "1.0", features = ["preserve_order"] }

crates/tauri-cli/config.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://schema.tauri.app/config/2.0.1",
+  "$id": "https://schema.tauri.app/config/2.0.2",
   "title": "Config",
   "description": "The Tauri configuration object.\n It is read from a file where you can define your frontend assets,\n configure the bundler and define a tray icon.\n\n The configuration file is generated by the\n [`tauri init`](https://v2.tauri.app/reference/cli/#init) command that lives in\n your Tauri application source directory (src-tauri).\n\n Once generated, you may modify it at will to customize your Tauri application.\n\n ## File Formats\n\n By default, the configuration is defined as a JSON file named `tauri.conf.json`.\n\n Tauri also supports JSON5 and TOML files via the `config-json5` and `config-toml` Cargo features, respectively.\n The JSON5 file name must be either `tauri.conf.json` or `tauri.conf.json5`.\n The TOML file name is `Tauri.toml`.\n\n ## Platform-Specific Configuration\n\n In addition to the default configuration file, Tauri can\n read a platform-specific configuration from `tauri.linux.conf.json`,\n `tauri.windows.conf.json`, `tauri.macos.conf.json`, `tauri.android.conf.json` and `tauri.ios.conf.json`\n (or `Tauri.linux.toml`, `Tauri.windows.toml`, `Tauri.macos.toml`, `Tauri.android.toml` and `Tauri.ios.toml` if the `Tauri.toml` format is used),\n which gets merged with the main configuration object.\n\n ## Configuration Structure\n\n The configuration is composed of the following objects:\n\n - [`app`](#appconfig): The Tauri configuration\n - [`build`](#buildconfig): The build configuration\n - [`bundle`](#bundleconfig): The bundle configurations\n - [`plugins`](#pluginconfig): The plugins configuration\n\n Example tauri.config.json file:\n\n ```json\n {\n   \"productName\": \"tauri-app\",\n   \"version\": \"0.1.0\",\n   \"build\": {\n     \"beforeBuildCommand\": \"\",\n     \"beforeDevCommand\": \"\",\n     \"devUrl\": \"../dist\",\n     \"frontendDist\": \"../dist\"\n   },\n   \"app\": {\n     \"security\": {\n       \"csp\": null\n     },\n     \"windows\": [\n       {\n         \"fullscreen\": false,\n         \"height\": 600,\n         \"resizable\": true,\n         \"title\": \"Tauri App\",\n         \"width\": 800\n       }\n     ]\n   },\n   \"bundle\": {},\n   \"plugins\": {}\n }\n ```",
   "type": "object",

crates/tauri-cli/metadata-v2.json

@@ -1,9 +1,9 @@
 {
   "cli.js": {
-    "version": "2.0.1",
+    "version": "2.0.2",
     "node": ">= 10.0.0"
   },
-  "tauri": "2.0.1",
+  "tauri": "2.0.2",
   "tauri-build": "2.0.1",
   "tauri-plugin": "2.0.1"
 }

crates/tauri-schema-generator/schemas/config.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://schema.tauri.app/config/2.0.1",
+  "$id": "https://schema.tauri.app/config/2.0.2",
   "title": "Config",
   "description": "The Tauri configuration object.\n It is read from a file where you can define your frontend assets,\n configure the bundler and define a tray icon.\n\n The configuration file is generated by the\n [`tauri init`](https://v2.tauri.app/reference/cli/#init) command that lives in\n your Tauri application source directory (src-tauri).\n\n Once generated, you may modify it at will to customize your Tauri application.\n\n ## File Formats\n\n By default, the configuration is defined as a JSON file named `tauri.conf.json`.\n\n Tauri also supports JSON5 and TOML files via the `config-json5` and `config-toml` Cargo features, respectively.\n The JSON5 file name must be either `tauri.conf.json` or `tauri.conf.json5`.\n The TOML file name is `Tauri.toml`.\n\n ## Platform-Specific Configuration\n\n In addition to the default configuration file, Tauri can\n read a platform-specific configuration from `tauri.linux.conf.json`,\n `tauri.windows.conf.json`, `tauri.macos.conf.json`, `tauri.android.conf.json` and `tauri.ios.conf.json`\n (or `Tauri.linux.toml`, `Tauri.windows.toml`, `Tauri.macos.toml`, `Tauri.android.toml` and `Tauri.ios.toml` if the `Tauri.toml` format is used),\n which gets merged with the main configuration object.\n\n ## Configuration Structure\n\n The configuration is composed of the following objects:\n\n - [`app`](#appconfig): The Tauri configuration\n - [`build`](#buildconfig): The build configuration\n - [`bundle`](#bundleconfig): The bundle configurations\n - [`plugins`](#pluginconfig): The plugins configuration\n\n Example tauri.config.json file:\n\n ```json\n {\n   \"productName\": \"tauri-app\",\n   \"version\": \"0.1.0\",\n   \"build\": {\n     \"beforeBuildCommand\": \"\",\n     \"beforeDevCommand\": \"\",\n     \"devUrl\": \"../dist\",\n     \"frontendDist\": \"../dist\"\n   },\n   \"app\": {\n     \"security\": {\n       \"csp\": null\n     },\n     \"windows\": [\n       {\n         \"fullscreen\": false,\n         \"height\": 600,\n         \"resizable\": true,\n         \"title\": \"Tauri App\",\n         \"width\": 800\n       }\n     ]\n   },\n   \"bundle\": {},\n   \"plugins\": {}\n }\n ```",
   "type": "object",

crates/tauri/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## \[2.0.2]
+
+### Enhancements
+
+- [`03e759042`](https://www.github.com/tauri-apps/tauri/commit/03e759042913e2ae9d45f299d6b6ad4b64ac3d2c) ([#11235](https://www.github.com/tauri-apps/tauri/pull/11235) by [@lucasfernog](https://www.github.com/tauri-apps/tauri/../../lucasfernog)) Added `App::invoke_key` and `AppHandle::invoke_key` for custom invoke systems that rely on manual `Webview::on_message` calls.
+
 ## \[2.0.1]
 
 ### What's Changed

crates/tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tauri"
-version = "2.0.1"
+version = "2.0.2"
 description = "Make tiny, secure apps for all desktop platforms with Tauri"
 exclude = ["/test", "/.scripts", "CHANGELOG.md", "/target"]
 readme = "README.md"

crates/tauri/src/app.rs

@@ -878,6 +878,15 @@ macro_rules! shared_app_impl {
           webview.resources_table().clear();
         }
       }
+
+      /// Gets the invoke key that must be referenced when using [`crate::webview::InvokeRequest`].
+      ///
+      /// # Security
+      ///
+      /// DO NOT expose this key to third party scripts as might grant access to the backend from external URLs and iframes.
+      pub fn invoke_key(&self) -> &str {
+        self.manager.invoke_key()
+      }
     }
 
     impl<R: Runtime> Listener<R> for $app {

package.json

@@ -28,7 +28,8 @@
   "packageManager": "pnpm@9.9.0",
   "pnpm": {
     "overrides": {
-      "rollup@>=4.0.0 <4.22.4": ">=4.22.4"
+      "rollup@>=4.0.0 <4.22.4": ">=4.22.4",
+      "cookie@<0.7.0": ">=0.7.0"
     }
   }
 }

packages/api/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## \[2.0.2]
+
+### What's Changed
+
+- [`e968b3d25`](https://www.github.com/tauri-apps/tauri/commit/e968b3d2527b8edf7653e6cf7284dc4a8889b5fe) ([#11219](https://www.github.com/tauri-apps/tauri/pull/11219) by [@lucasfernog](https://www.github.com/tauri-apps/tauri/../../lucasfernog)) Actually publish package with the latest tag.
+
 ## \[2.0.1]
 
 ### What's Changed

packages/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tauri-apps/api",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "description": "Tauri API definitions",
   "funding": {
     "type": "opencollective",
@@ -38,7 +38,7 @@
   "scripts": {
     "build": "rollup -c --configPlugin typescript",
     "npm-pack": "pnpm build && cd ./dist && npm pack",
-    "npm-publish": "pnpm build && cd ./dist && pnpm publish --access public --loglevel silly --tag next --no-git-checks",
+    "npm-publish": "pnpm build && cd ./dist && pnpm publish --access public --loglevel silly --no-git-checks",
     "ts:check": "tsc --noEmit",
     "eslint:check": "eslint src/**.ts",
     "eslint:fix": "eslint src/**.ts --fix"

packages/cli/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## \[2.0.2]
+
+### What's Changed
+
+- [`4475fbb50`](https://www.github.com/tauri-apps/tauri/commit/4475fbb502c5ffb3cea4de6bef1c7869be39bed6) ([#11208](https://www.github.com/tauri-apps/tauri/pull/11208) by [@lucasfernog](https://www.github.com/tauri-apps/tauri/../../lucasfernog)) Update cargo-mobile2 to 0.17.3, fixing lib name validation.
+- [`a49a19ffa`](https://www.github.com/tauri-apps/tauri/commit/a49a19ffa304f031fb1a04d31a567cc7f42a380a) ([#11218](https://www.github.com/tauri-apps/tauri/pull/11218)) Fix bundling `appimage`, `deb` and `rpm` bundles failing to open when using `mainBinaryName` with spaces.
+
+### Dependencies
+
+- Upgraded to `tauri-cli@2.0.2`
+
 ## \[2.0.1]
 
 ### Dependencies

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tauri-apps/cli",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "description": "Command line interface for building Tauri apps",
   "funding": {
     "type": "opencollective",

pnpm-lock.yaml

@@ -6,6 +6,7 @@ settings:
 
 overrides:
   rollup@>=4.0.0 <4.22.4: '>=4.22.4'
+  cookie@<0.7.0: '>=0.7.0'
 
 importers:
 
@@ -1300,8 +1301,8 @@ packages:
   convert-source-map@2.0.0:
     resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
 
-  cookie@0.5.0:
-    resolution: {integrity: sha512-YZ3GUyn/o8gfKJlnlX7g7xq4gyO6OSuhGPKaaGssGB2qgDUS0gPgtTvoyZLTt9Ab6dC4hfc9dV5arkvc/OCmrw==}
+  cookie@0.7.1:
+    resolution: {integrity: sha512-6DnInpx7SJ2AK3+CTUE/ZM0vWTUboZCegxhC2xiIydHR9jNuTAASBrfEpHhiGOZw/nX51bHt6YQl8jsGo4y/0w==}
     engines: {node: '>= 0.6'}
 
   cross-env@7.0.3:
@@ -3418,7 +3419,7 @@ snapshots:
 
   convert-source-map@2.0.0: {}
 
-  cookie@0.5.0: {}
+  cookie@0.7.1: {}
 
   cross-env@7.0.3:
     dependencies:
@@ -4438,7 +4439,7 @@ snapshots:
 
   youch@3.3.3:
     dependencies:
-      cookie: 0.5.0
+      cookie: 0.7.1
       mustache: 4.2.0
       stacktracey: 2.1.8