Backport glib VariantStrIter security fix

[krutftw]

What changed

• Vendor the official glib 0.18.5 crate and pin the Linux Tauri dependency graph to it.
• Backport the exact two-line VariantStrIter pointer fix from gtk-rs commit 05dff0ee696f9bcd8617cd48c4b812d046d440cb.
• Record the crate checksum and upstream provenance beside the vendored source.
• Add a CI regression test for the source override, lockfile, fix, and provenance.

Why this is a backport

Tauri 2.11 still uses the GTK3 crate line that requires glib 0.18. A normal dependency update cannot select the first patched glib release, 0.20.0, without a wider GTK/Tauri migration. This keeps the supported Tauri graph and applies the maintainers' fix directly.

Advisory: GHSA-wrw7-89jp-8q8g
Upstream fix: gtk-rs/gtk-rs-core#1343
Dependabot alert: https://github.com/krutftw/bitcoin09/security/dependabot/1

Verification

• Official crate SHA-256 verified: 233daaf6e83ae6a12a52055f568f9d7cf4671dabb78ff9560ab6da230ce00ee5
• Mechanical comparison against the official crate found only the upstream two-line source fix plus BTC09-PATCH.md.
• Windows cargo test --locked: 9 passed.
• Linux cargo tree resolves glib to walletapp/vendor/glib-0.18.5-btc09.
• Linux cargo test --locked: 9 passed.
• Optimized Linux full-wallet build: passed.
• Optimized Linux wallet-only build and core-boundary verification: passed.
• Release and CI contract suite: 37 passed.

[gemini-code-assist]

Code Review

This pull request vendors the glib crate (version 0.18.5) with a backported security fix for VariantStrIter::impl_get to address a vulnerability in the Linux Tauri/GTK wallet dependency graph, updating Cargo.toml and Cargo.lock accordingly. It also adds a Python test script to verify the security patch and lock configuration. Feedback on the changes suggests adding a fallback for tomllib in the Python test script to ensure compatibility with Python versions older than 3.11.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 196b29bd2f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".