Update Feat/cef with upstream

.cargo/audit.toml

@@ -8,4 +8,17 @@ ignore = [
   "RUSTSEC-2024-0370",
   # time crate can't be updated in the repo because of MSRV, users are unaffected
   "RUSTSEC-2026-0009",
+  # rand unsoundness, fixed when we remove kuchikiki from deps in v3, currently
+  # remains for semver reasons but is not built in default configuration
+  "RUSTSEC-2026-0097",
+  # glib 0.18.5 unsoundness, fixed by updating to gtk4
+  "RUSTSEC-2024-0429",
+  # rustls, fixed when updating to apple-codesign 0.28.0
+  "RUSTSEC-2026-0049",
+  # rustls, fixed when updating to apple-codesign 0.28.0
+  "RUSTSEC-2026-0098",
+  # rustls, fixed when updating to apple-codesign 0.28.0
+  "RUSTSEC-2026-0099",
+  # rustls, fixed when updating to apple-codesign 0.28.0
+  "RUSTSEC-2026-0104",
 ]

.changes/bundle-vc-runtime.md

@@ -0,0 +1,7 @@
+---
+"tauri-bundler": "minor:feat"
+"tauri-cli": "minor:feat"
+"tauri-utils": "minor:feat"
+---
+
+Added `bundle.windows.bundleVCRuntime` to copy the Visual C++ runtime DLLs into Windows MSI and NSIS installers. The bundler locates the runtime through `VCTOOLS_REDIST_DIR` or the bundled `vswhere.exe`.

.changes/static-vc-runtime.md

@@ -0,0 +1,6 @@
+---
+"tauri-cli": "minor:feat"
+"tauri-utils": "minor:feat"
+---
+
+Added `build.windows.staticVCRuntime` to control MSVC static runtime linking. The `STATIC_VCRUNTIME` environment variable is now deprecated and emits a migration warning when used.

.changes/tauri-build-static-vc-runtime.md

@@ -0,0 +1,5 @@
+---
+"tauri-build": "minor:feat"
+---
+
+Added `tauri_build::WindowsAttributes::static_vc_runtime` to control MSVC static runtime linking from build scripts.

.github/workflows/audit.yml

@@ -16,6 +16,8 @@ on:
       - '**/package.json'
       - '**/pnpm-lock.yaml'
   push:
+    branches:
+      - dev
     paths:
       - '.github/workflows/audit.yml'
       - '**/Cargo.lock'

.github/workflows/lint-rust.yml

@@ -12,6 +12,8 @@ on:
     paths:
       - '.github/workflows/lint-rust.yml'
       - 'crates/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
 
 env:
   RUST_BACKTRACE: 1

.github/workflows/publish-cli-js.yml

@@ -53,26 +53,34 @@ jobs:
             docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-debian
             build: |
               npm i -g --force corepack
+              rustup install 1.88.0
+              rustup default 1.88.0
               cd packages/cli
               pnpm build --target x86_64-unknown-linux-gnu
               strip *.node
           - host: ubuntu-22.04
             target: x86_64-unknown-linux-musl
             docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-alpine
             build: |
+              rustup install 1.88.0
+              rustup default 1.88.0
               cd packages/cli
               pnpm build
               strip *.node
           - host: macos-latest
             target: aarch64-apple-darwin
             build: |
+              rustup target add x86_64-apple-darwin
               pnpm build --features native-tls-vendored --target=aarch64-apple-darwin
               strip -x *.node
           - host: ubuntu-22.04
             target: aarch64-unknown-linux-gnu
             docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-debian-aarch64
             build: |
               npm i -g --force corepack
+              rustup install 1.88.0
+              rustup default 1.88.0
+              rustup target add aarch64-unknown-linux-gnu
               cd packages/cli
               pnpm build --target aarch64-unknown-linux-gnu
               aarch64-unknown-linux-gnu-strip *.node
@@ -90,8 +98,10 @@ jobs:
             target: aarch64-unknown-linux-musl
             docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-alpine
             build: |
-              cd packages/cli
+              rustup install 1.88.0
+              rustup default 1.88.0
               rustup target add aarch64-unknown-linux-musl
+              cd packages/cli
               pnpm build --target aarch64-unknown-linux-musl
               /aarch64-linux-musl-cross/bin/aarch64-linux-musl-strip *.node
           - host: ubuntu-22.04
@@ -107,6 +117,8 @@ jobs:
     runs-on: ${{ matrix.settings.host }}
     steps:
       - uses: actions/checkout@v4
+      - name: Prepare CEF package metadata and versions
+        run: node ../../.scripts/ci/prepare-cli-cef-publish.js
       - run: npm i -g --force corepack
       - name: Setup node
         uses: actions/setup-node@v4
@@ -136,7 +148,12 @@ jobs:
         if: ${{ matrix.settings.docker }}
         with:
           image: ${{ matrix.settings.docker }}
-          options: --user 0:0 -v ${{ github.workspace }}/.cargo-cache/git/db:/root/.cargo/git/db -v ${{ github.workspace }}/.cargo/registry/cache:/root/.cargo/registry/cache -v ${{ github.workspace }}/.cargo/registry/index:/root/.cargo/registry/index -v ${{ github.workspace }}:/build -w /build
+          options: --user 0:0 -v ${{ github.workspace
+            }}/.cargo-cache/git/db:/root/.cargo/git/db -v ${{ github.workspace
+            }}/.cargo/registry/cache:/root/.cargo/registry/cache -v ${{
+            github.workspace
+            }}/.cargo/registry/index:/root/.cargo/registry/index -v ${{
+            github.workspace }}:/build -w /build
           run: ${{ matrix.settings.build }}
 
       - name: Build
@@ -345,7 +362,8 @@ jobs:
       - uses: addnab/docker-run-action@v3
         with:
           image: ${{ matrix.image }}
-          options: '-v ${{ github.workspace }}:/build -w /build -e RUSTUP_HOME=/usr/local/rustup -e CARGO_HOME=/usr/local/cargo'
+          options: '-v ${{ github.workspace }}:/build -w /build -e
+            RUSTUP_HOME=/usr/local/rustup -e CARGO_HOME=/usr/local/cargo'
           shell: bash
           run: |
             set -e
@@ -386,12 +404,14 @@ jobs:
           path: packages/cli/artifacts
       - name: Move artifacts
         run: pnpm artifacts
+      - name: Rewrite package names for CEF publish
+        run: node ../../.scripts/ci/prepare-cli-cef-publish.js
       - name: List packages
         run: ls -R ./npm
         shell: bash
       - name: Publish
         run: |
-          npm publish
+          npm publish --tag latest
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NODE_AUTH_TOKEN: ''

.github/workflows/publish-cli-rs.yml

@@ -76,22 +76,21 @@ jobs:
 
       - name: Build CLI
         if: ${{ !matrix.config.cross }}
-        run: cargo build --manifest-path ./crates/tauri-cli/Cargo.toml --profile release-size-optimized ${{ matrix.config.args }}
+        run: >-
+          cargo build --manifest-path ./crates/tauri-cli/Cargo.toml
+          --target ${{ matrix.config.rust_target }}
+          --profile release-size-optimized
+          ${{ matrix.config.args }}
 
       - name: Build CLI (cross)
         if: ${{ matrix.config.cross }}
-        run: cross build --manifest-path ./crates/tauri-cli/Cargo.toml --target ${{ matrix.config.rust_target }} --profile release-size-optimized ${{ matrix.config.args }}
+        run: >-
+          cross build --manifest-path ./crates/tauri-cli/Cargo.toml
+          --target ${{ matrix.config.rust_target }}
+          --profile release-size-optimized
+          ${{ matrix.config.args }}
 
       - name: Upload CLI
-        if: ${{ !matrix.config.cross }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: cargo-tauri-${{ matrix.config.rust_target }}${{ matrix.config.ext }}
-          path: target/release-size-optimized/cargo-tauri${{ matrix.config.ext }}
-          if-no-files-found: error
-
-      - name: Upload CLI (cross)
-        if: ${{ matrix.config.cross }}
         uses: actions/upload-artifact@v4
         with:
           name: cargo-tauri-${{ matrix.config.rust_target }}${{ matrix.config.ext }}

.github/workflows/test-cli-rs.yml

@@ -14,6 +14,8 @@ on:
       - 'crates/tauri-utils/**'
       - 'crates/tauri-bundler/**'
       - 'crates/tauri-cli/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
 
 env:
   RUST_BACKTRACE: 1

.github/workflows/test-core.yml

@@ -12,6 +12,8 @@ on:
     paths:
       - '.github/workflows/test-core.yml'
       - 'crates/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
       - '!crates/tauri/scripts/**'
       - '!crates/tauri-cli/**'
       - '!crates/tauri-bundler/**'

.scripts/ci/prepare-cli-cef-publish.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+
+// Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT
+
+const { readdirSync, readFileSync, writeFileSync } = require('node:fs')
+const { join } = require('node:path')
+
+const SOURCE_NAME = '@tauri-apps/cli'
+const TARGET_NAME = '@tauri-apps/cli-cef'
+
+const cliDir = process.cwd()
+const npmDir = join(cliDir, 'npm')
+const cefCliVersionPath = join(cliDir, '.cef-cli-version')
+const tauriCliCargoTomlPath = join(cliDir, '../../crates/tauri-cli/Cargo.toml')
+
+const cefCliVersion = readFileSync(cefCliVersionPath, 'utf8').trim()
+
+if (!cefCliVersion) {
+  throw new Error(`expected a version in ${cefCliVersionPath}`)
+}
+
+function rewritePackageName(packageJsonPath, setVersion = false) {
+  const pkg = JSON.parse(readFileSync(packageJsonPath, 'utf8'))
+  if (setVersion) {
+    pkg.version = cefCliVersion
+  }
+  if (typeof pkg.name === 'string' && pkg.name.startsWith(SOURCE_NAME)) {
+    pkg.name = pkg.name.replace(SOURCE_NAME, TARGET_NAME)
+  }
+  writeFileSync(packageJsonPath, `${JSON.stringify(pkg, null, 2)}\n`)
+  console.log(`updated package metadata in ${packageJsonPath}`)
+}
+
+rewritePackageName(join(cliDir, 'package.json'), true)
+
+for (const entry of readdirSync(npmDir, { withFileTypes: true })) {
+  if (!entry.isDirectory()) {
+    continue
+  }
+  rewritePackageName(join(npmDir, entry.name, 'package.json'))
+}
+
+const indexJsPath = join(cliDir, 'index.js')
+const indexContents = readFileSync(indexJsPath, 'utf8')
+const rewrittenIndexContents = indexContents.replace(
+  /@tauri-apps\/cli(?=[-/'"`])/g,
+  TARGET_NAME
+)
+
+if (rewrittenIndexContents !== indexContents) {
+  writeFileSync(indexJsPath, rewrittenIndexContents)
+  console.log(`rewrote native binding imports in ${indexJsPath}`)
+}
+
+const tauriCliCargoToml = readFileSync(tauriCliCargoTomlPath, 'utf8')
+const tauriCliCargoTomlWithVersion = tauriCliCargoToml.replace(
+  /^version = ".*"$/m,
+  `version = "${cefCliVersion}"`
+)
+
+if (tauriCliCargoTomlWithVersion !== tauriCliCargoToml) {
+  writeFileSync(tauriCliCargoTomlPath, tauriCliCargoTomlWithVersion)
+  console.log(`updated tauri-cli version in ${tauriCliCargoTomlPath}`)
+}