@aiwg/cockpit 2026.8.25 → 2026.8.26
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/desktop/README.md +16 -0
- package/desktop/src-tauri/Cargo.lock +390 -285
- package/package.json +1 -1
- package/web/dist/assets/{index-DdWLHb_H.js → index-D-aygfxh.js} +118 -118
- package/web/dist/index.html +1 -1
package/desktop/README.md
CHANGED
|
@@ -36,6 +36,22 @@ frontend splash, a locked Rust dependency graph, and the generated desktop icon
|
|
|
36
36
|
set needed by Tauri. `cargo tauri build` has been verified on Linux to produce
|
|
37
37
|
`.deb`, `.rpm`, and `.AppImage` bundles.
|
|
38
38
|
|
|
39
|
+
## Linux dependency security boundary
|
|
40
|
+
|
|
41
|
+
The desktop does not accept XML or plist input at its application boundary.
|
|
42
|
+
Tauri's build/configuration stack brings in `plist` and `quick-xml`; the locked
|
|
43
|
+
graph must retain `quick-xml >=0.41.0` so crafted duplicate attributes or
|
|
44
|
+
namespace declarations cannot trigger the RustSec denial-of-service flaws even
|
|
45
|
+
if that upstream boundary changes.
|
|
46
|
+
|
|
47
|
+
Linux rendering remains owned by the Cockpit maintainers and currently follows
|
|
48
|
+
Tauri/Wry's GTK backend. Tauri 2.11.5 and Wry 0.55.1 still require GTK3 bindings
|
|
49
|
+
and `glib 0.18`; upgrading `glib` alone is ABI/API incompatible. The upstream
|
|
50
|
+
GTK4 migration is tracked by `tauri-apps/tauri#12561` and the related Tao/Wry
|
|
51
|
+
GTK4 work. Before the next desktop release, maintainers must either qualify an
|
|
52
|
+
upstream GTK4 release that resolves `glib >=0.20` or hold the Linux bundle. A
|
|
53
|
+
floating Git dependency or an audit ignore is not an accepted remediation.
|
|
54
|
+
|
|
39
55
|
## Why a token file (not a socket handshake)
|
|
40
56
|
|
|
41
57
|
The runtime file is the cross-platform handshake every shell shares (see
|