From 43a43f58a9a0e4019ea5ad5af260b5191a4ffcdd Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 08:55:55 +0000 Subject: [PATCH 1/2] chore(deps): bump tauri-plugin-shell to 2.2.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes CVE-2025-31477 (GHSA-c9pr-q8gx-3mgp): the shell plugin's `open` endpoint accepted dangerous protocols (file:, smb:, nfs:) when scope validation silently fell back to allow-all. Patch release; dependency set identical to 2.2.0. Supersedes Dependabot PR #570, which is unmergeable — it branched before dev gained the [profile.release.build-override] block, so its Cargo.toml diff deletes that profile on merge. Co-Authored-By: Epinephrine --- desktop/src-tauri/Cargo.lock | 4 ++-- desktop/src-tauri/Cargo.toml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock index 95bc1a674a..03fbb85ca9 100644 --- a/desktop/src-tauri/Cargo.lock +++ b/desktop/src-tauri/Cargo.lock @@ -3968,9 +3968,9 @@ dependencies = [ [[package]] name = "tauri-plugin-shell" -version = "2.2.0" +version = "2.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bb2c50a63e60fb8925956cc5b7569f4b750ac197a4d39f13b8dd46ea8e2bad79" +checksum = "69d5eb3368b959937ad2aeaf6ef9a8f5d11e01ffe03629d3530707bbcb27ff5d" dependencies = [ "encoding_rs", "log", diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml index 2548b000cd..41db839348 100644 --- a/desktop/src-tauri/Cargo.toml +++ b/desktop/src-tauri/Cargo.toml @@ -23,7 +23,7 @@ tauri = { version = "=2.11.6", features = ["tray-icon", "image-png"] } tauri-plugin-autostart = "=2.5.0" tauri-plugin-opener = "=2.5.3" tauri-plugin-process = "=2.3.0" -tauri-plugin-shell = "=2.2.0" +tauri-plugin-shell = "=2.2.1" tauri-plugin-single-instance = "=2.4.0" tauri-plugin-updater = "=2.9.0" tokio = { version = "=1.45.1", features = ["sync", "time"] } From 184f8716f29fd87f593e7305ec9b05a974ea3f7a Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 14:39:20 +0000 Subject: [PATCH 2/2] ci: retrigger platform-macos (previous leg cancelled)