Psychotoxical-psysonic

mirror of https://github.com/Psychotoxical/psysonic.git synced 2026-07-22 15:25:46 +00:00

Files

T

Frank Stellmacher dc2068303d chore(deps): bump Tauri 2.11.0 → 2.11.1 (GHSA-7gmj-67g7-phm9) (#509 )

* chore(deps): bump Tauri 2.11.0 → 2.11.1 (GHSA-7gmj-67g7-phm9)

Patches the IPC origin-confusion advisory: Tauri 2.11.0 and below could
let a remote-origin page loaded inside the webview invoke local-only
IPC commands. Severity medium. Psysonic exposes a number of file-system
and credential-bearing IPC commands (download_zip, nd_get_song_path,
audio_*), so closing the gate is worth the lockfile-only bump.

Cargo.toml is unlocked at "2", so this is purely a Cargo.lock refresh
via `cargo update -p tauri --precise 2.11.1`. Full Tauri family bumped
together (tauri / tauri-build / tauri-codegen / tauri-macros /
tauri-runtime / tauri-runtime-wry / tauri-utils — all matching patch
releases). wry, tao and other transitive deps unchanged. phf 0.11.3
fell out of the dependency graph because the new tauri-utils no longer
pulls it.

Tested locally (Windows): tray hide/restore + single-instance second
launch + mini-player toggle + window-state persistence — all working.

* docs: changelog entry for PR #509

Logs the Tauri 2.11.1 GHSA security bump in v1.46.0 "## Fixed".

2026-05-07 22:43:15 +02:00