fix(deps): bump tauri to >=2.11.1 (GHSA-7gmj-67g7-phm9 / CVE-2026-42184)

[aeonframework]

Summary

Bumps tauri from 2.0 to 2.11.1 in tauri/src-tauri/Cargo.toml to require a version that includes the fix for GHSA-7gmj-67g7-phm9 (CVE-2026-42184, CVSS 8.8).

Vulnerability: Tauri origin confusion (GHSA-7gmj-67g7-phm9)

Tauri 2.x is_local_url() only checks the first subdomain label, so a URL like tauri.evil.com would be treated as trusted on Windows and Android, allowing a remote page to reach the local IPC bridge. Fixed in Tauri 2.11.1.

Affected: tauri@2.9.5 (current lock)
Fixed in: tauri@2.11.1
Severity: High (CVSS 8.8)

Additional CVEs in current Cargo.lock

These may resolve when the Tauri update pulls in newer transitive deps:

Dep	Advisory	Severity
openssl@0.10.75	GHSA-8c75-8mhr-p7r9 + 6 more	High
quinn-proto@0.11.13	GHSA-6xvm-j4wr-6v98	High (DoS)
tar@0.4.44	GHSA-gchp-q4r4-x4ff	Moderate (path traversal)

Steps to update Cargo.lock after merging

cargo update -p tauri --precise 2.11.1

---

Reported by Aeon automated security scanner.

Summary by CodeRabbit

• Chores
  • Updated the underlying desktop framework to version 2.11.1.
  • No visible feature or configuration changes.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• tauri/src-tauri/Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7a05e811-445c-4f0a-9ff4-549b9a22cd9b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The Tauri dependency in tauri/src-tauri/Cargo.toml is upgraded from version 2.0 to 2.11.1, retaining the macos-private-api feature.

Changes

Tauri dependency update

Layer / File(s)	Summary
Update Tauri dependency version tauri/src-tauri/Cargo.toml	The Tauri crate version changes from 2.0 to 2.11.1 while retaining the existing feature set.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: jamiepine

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the Tauri dependency bump and related security fix in Cargo.toml.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tauri/src-tauri/Cargo.toml`:
- Line 16: Update the Cargo.lock entry for the tauri dependency to resolve
precisely to version 2.11.1, matching the declaration in Cargo.toml. Run cargo
update -p tauri --precise 2.11.1 and commit all resulting lockfile changes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ad7f5e39-950a-4d0d-86ed-2a68484a5eb9

📥 Commits

Reviewing files that changed from the base of the PR and between 52f8d8d and 1f50719.

📒 Files selected for processing (1)

• tauri/src-tauri/Cargo.toml