toolchain(tauri): align JS/CLI/Rust Tauri 2.x versions and establish a bounded transitional update policy

[qnbs]

Final v1.29 disposition — 2026-09-29

#888 + #901 are terminally DEFERRED_WITH_RELEASE_SAFE_EVIDENCE for v1.29.

Do not refresh, rebase or merge this Tauri/updater pair during release preparation or candidate qualification. The current Tauri/updater stack is the v1.29 baseline.

Pre-tag evidence is instead:

• tauri-plugins:check / resolved-lockfile parity;
• exact-candidate Linux/Windows/macOS-ARM dispatch build;
• bounded updater/release dry-run evidence available without tag-only secrets.

Resume this owner after v1.29 and re-fetch the then-current Rust + JS Tauri graph before admitting any paired update.

---

v1.29 dependency disposition — 2026-09-29

GH #888 (Rust Tauri group) and #901 (@tauri-apps/plugin-updater 2.11.0 → 2.12.0) are deferred past v1.29 unless new security/release evidence requires admission.

Reason:

• both touch the updater compatibility surface immediately before a release delivered through that updater;
• the current stack has already passed fresh Linux/Windows/macOS release qualification;
• admitting the pair now would require coherent JS↔Rust parity, new native qualification, updater signature/latest.json verification, and preferably a real v1.28.8 → candidate update-path test;
• this scope expansion is not justified merely to clear Dependabot.

Disposition: DEFERRED_WITH_RELEASE_SAFE_EVIDENCE.

After v1.29, re-fetch both PRs and current main, then admit the smallest coherent Tauri maintenance slice.

---

Pre-v1.29 dependency-wave handoff — 2026-09-29

The release owner #872 has delegated one current pre-release compatibility decision here:

• build(deps): bump the tauri-deps group across 1 directory with 5 updates #888 updates the Rust Tauri dependency group in /src-tauri;
• build(deps): bump @tauri-apps/plugin-updater from 2.11.0 to 2.12.0 #901 updates @tauri-apps/plugin-updater on the JavaScript side.

These PRs overlap in the updater/Tauri compatibility surface and must not be treated as two unrelated green-bot merges.

Before either is admitted, re-read both live PRs after #881/resulting-main convergence and produce one JS/Rust compatibility disposition covering:

Rust tauri/plugin versions
JS @tauri-apps/* versions
updater JS↔Rust pairing
Cargo.lock + pnpm-lock.yaml
capability/config compatibility
latest.json/signature/update path
Linux/Windows/macOS packaged qualification as affected

One PR may become redundant after the other/base refreshes. Prefer a coherent compatible stack over clearing both PR numbers.

---

Context

WorldScript Studio is intentionally in a transitional native phase:

current packaged desktop = Tauri 2
future primary native renderer = Qt 6 + Qt Quick/QML
shared long-term native authority = renderer-neutral Rust Core

Tauri therefore still needs to remain secure, reproducible and supportable until its formal retirement gates are met, but it should not receive broad new architecture solely for its own sake.

The current Tauri dependency surface is split across different 2.x release points.

Observed current repository state includes approximately:

JavaScript:
  @tauri-apps/api        ^2.11.1
  @tauri-apps/cli        ^2.11.4
  plugins                various 2.x releases

Rust:
  tauri                  2.10.3
  tauri-build            2.5.6
  tauri plugins          mostly broad "2" ranges

Current upstream Tauri ecosystem releases as of 2026-09-01 include:

tauri crate              2.11.5
@tauri-apps/api           2.11.1
@tauri-apps/cli           2.11.4
tauri-build               2.6.3

Official ecosystem release reference:
https://tauri.app/release/

Full Tauri changelog:
https://tauri.app/release/tauri/all-versions/

Version differences are not automatically incorrect because Tauri's packages have independent release cadences. However, WorldScript currently lacks one explicit compatibility/update contract describing which combinations are supported and how updates are admitted.

This issue owns bounded Tauri 2.x toolchain/version alignment and maintenance policy during the transition to Qt.

It does not own Tauri lifecycle/performance defects (#332), native security architecture (#445), Intel macOS qualification (#507), or Qt implementation.

Goal

1. Inventory the complete JS/Rust Tauri ecosystem graph actually used by WorldScript.
2. Remove accidental stale/skewed versions where a vetted current 2.x combination is safer and compatible.
3. Define which Tauri packages should be exact/pinned versus semver-ranged.
4. Establish a bounded maintenance policy for future Tauri 2.x security/bugfix updates.
5. Preserve packaged desktop behavior while avoiding major Tauri-specific architecture expansion before Qt.

---

Full Tauri ecosystem inventory

Before mutation, record every direct Tauri dependency on both sides of the bridge.

JavaScript / npm

At minimum inspect:

• @tauri-apps/api;
• @tauri-apps/cli;
• @tauri-apps/plugin-dialog;
• @tauri-apps/plugin-fs;
• @tauri-apps/plugin-http;
• @tauri-apps/plugin-notification;
• @tauri-apps/plugin-process;
• @tauri-apps/plugin-shell;
• @tauri-apps/plugin-updater;
• any other Tauri npm plugin actually installed.

Rust / Cargo

At minimum inspect:

• tauri;
• tauri-build;
• tauri-plugin-log;
• tauri-plugin-fs;
• tauri-plugin-http;
• tauri-plugin-dialog;
• tauri-plugin-shell;
• tauri-plugin-updater;
• tauri-plugin-window-state;
• tauri-plugin-deep-link;
• tauri-plugin-single-instance;
• tauri-plugin-notification;
• tauri-plugin-process.

Tooling/config

Also inventory:

• src-tauri/tauri.conf.json;
• capabilities/permissions;
• updater configuration/public key;
• release signing;
• target-specific bundle configuration;
• Tauri build workflows;
• Rust toolchain/MSRV relationship (toolchain(rust): define deterministic build toolchain, explicit MSRV policy and Core/Tauri compatibility lanes #572);
• Tauri CLI invocation from npm scripts;
• desktop import-boundary/native-readiness gates.

Produce a compatibility table:

Component	Requested	Locked	Upstream current 2.x	Compatibility evidence	Action
tauri Rust
tauri-build
JS API
CLI
plugin X

Do not infer that every component should share an identical patch number; use upstream compatibility/release evidence.

---

Recover why current pins/ranges exist

For any unusually old, exact or broad entry, inspect git history and linked PRs/issues.

Classify each as:

CURRENT_AND_INTENTIONAL
STALE_BUT_COMPATIBLE
SECURITY_PIN
UPSTREAM_REGRESSION_PIN
PACKAGING_COMPATIBILITY_PIN
UNBOUNDED_RANGE_NEEDS_POLICY
UNKNOWN_NEEDS_PROOF

Do not remove a historical workaround without first reproducing/invalidating its reason.

---

Alignment target

Prefer one vetted compatible Tauri 2.x stack rather than independent accidental drift.

A valid target may have different exact package versions because upstream publishes packages separately, but it must satisfy:

JS API ↔ Rust command/runtime compatibility
CLI ↔ config/bundle compatibility
plugin JS ↔ plugin Rust compatibility where paired
updater ↔ release/signature compatibility
capability/permission schema compatibility

Where paired npm/Rust plugins have documented matching constraints, encode those explicitly.

Do not assume broad Cargo "2" ranges are necessarily the desired long-term policy merely because they currently resolve.

---

Pin/range policy

Define a repository rule for each category.

Candidate policy:

Tauri CLI / build-critical packages
→ exact or tightly controlled versions for reproducible packaging

runtime JS/Rust libraries
→ bounded compatible 2.x ranges where lockfiles provide exact authority

security/updater components
→ explicit audited update path

The final policy must account for:

• both pnpm-lock.yaml and Cargo.lock exact resolutions;
• Dependabot/update tooling;
• fresh-resolution canary toolchain(pnpm): add non-frozen fresh-resolution canary for registry, override and lockfile integrity #570;
• OSV/SCA security(ci): add a scheduled OSV/SCA scan for unchanged main #448;
• release reproducibility/provenance supply-chain: document trust-policy gaps across Docker/GHCR, Tauri release artifacts, and pnpm dependency provenance #529.

Do not create unnecessary duplicate override layers if lockfile authority already provides sufficient determinism.

---

Bounded upgrade execution

If the inventory supports alignment to current vetted Tauri 2.11.x ecosystem versions, perform it in one or more small causal PRs rather than a mega-update.

Suggested split if needed:

A. core Tauri runtime/build/CLI alignment
B. plugin-family alignment
C. updater/release-sensitive update if material

Keep each PR small enough that a packaging regression can be attributed to one change set.

Do not include unrelated React/Vite/TS/Rust-Core feature work.

---

Required compile/static evidence

At minimum:

pnpm install --frozen-lockfile
pnpm run typecheck
pnpm run lint
pnpm run build
Tauri Rust cargo check/test gate
cargo fmt --check
clippy according to repo policy
native-readiness gate
desktop import-boundary gate

Any permission/capability schema change must be inspected explicitly; do not fix it by widening capabilities globally.

---

Packaged desktop acceptance

Because Tauri runtime/plugin updates can pass compile-time gates while breaking WebView/native integration, require packaged evidence appropriate to affected components.

Core shell

• launch/close/relaunch;
• window state;
• normal menu/tray behavior;
• deep links / single instance;
• external navigation boundaries.

Filesystem/storage

• project open/save/autosave;
• filesystem plugin operations;
• current preserve-first recovery behavior;
• no storage migration implied merely by library update.

R-15 design/implementation remains #445 and must not be pulled into a Tauri version bump.

Dialog/shell/process/notification

Verify the commands actually consumed by WorldScript rather than generic plugin examples.

Updater

If updater packages change, verify:

latest.json handling
signature verification
rejected invalid signature
update download
safe relaunch behavior

Coordinate provenance/signing with #529.

Platform matrix

At minimum preserve evidence on supported production packaging platforms according to the current release matrix.

Intel macOS qualification remains #507 rather than becoming an implicit requirement of every Tauri patch.

---

#332 relationship — no deep Tauri detour

Tauri updates may incidentally affect WebKitGTK/window/runtime behavior relevant to #332.

If a newer Tauri runtime materially fixes an existing lifecycle/performance problem with a narrow normal update, record that evidence on #332.

Do not use this issue to launch:

• custom WebKitGTK forks;
• broad GPU/compositor workaround architecture;
• renderer recovery subsystems;
• Tauri-only Core semantics.

The existing stop rule in #332 remains authoritative.

---

Qt relationship

The purpose of this work is to keep the transitional desktop healthy until retirement, not to delay Qt admission until Tauri is perfect.

Required principle:

Tauri maintenance
= security + correctness + reproducibility + bounded upstream bugfix uptake

NOT
= new long-lived product architecture that Qt will immediately replace

Renderer-neutral improvements belong in Rust Core/DesktopPlatform contracts, not hidden in Tauri plugin-specific helpers.

---

Rust toolchain / MSRV relationship

Coordinate with #572.

A Tauri 2.x update may raise the minimum supported Rust version. If so:

• prove the exact crate/dependency that raises it;
• update MSRV policy through toolchain(rust): define deterministic build toolchain, explicit MSRV policy and Core/Tauri compatibility lanes #572 evidence;
• do not silently make the build compiler the new MSRV;
• avoid combining a large Rust toolchain jump and Tauri dependency jump unless compatibility requires it.

---

Security / dependency review

Every Tauri alignment PR must run:

• Cargo OSV/SCA;
• npm OSV/dependency review where JS packages move;
• updater/signature tests if relevant;
• existing workflow/signature/governance gates.

Do not suppress a newly surfaced advisory merely to retain an older transitional Tauri release if a compatible fixed release exists.

---

Future Tauri update policy

After alignment, document maintenance classes:

SECURITY PATCH
→ high priority bounded update + normal packaged evidence

BUGFIX PATCH/MINOR
→ update when relevant/stable under cooldown policy

FEATURE-ONLY MINOR
→ adopt only if needed for current product/maintenance

TAURI MAJOR
→ no automatic migration; separate architecture decision given Qt trajectory

This avoids spending roadmap capacity on feature churn in a renderer scheduled for eventual retirement.

---

Rollback

Tauri dependency updates must be reversible through dependency/lockfile/config reversion.

Do not couple a dependency alignment to an irreversible project-data migration.

If a newer Tauri release introduces a platform regression:

ROLL_BACK / PIN
+ record upstream issue
+ retain security assessment

rather than papering over it with a large platform-specific workaround.

---

Acceptance criteria

• Complete npm + Cargo Tauri ecosystem inventory exists.
• Every current version mismatch/pin/range is classified as intentional, obsolete or needing correction.
• JS API, CLI, Rust runtime/build and paired plugins have a documented compatibility matrix.
• Accidental stale/skewed versions are aligned to a vetted supported Tauri 2.x combination.
• Remaining intentional skew has explicit upstream/compatibility rationale and removal conditions.
• Reproducible pin/range policy is documented for build-critical/runtime/plugin categories.
• pnpm and Cargo lockfiles remain exact install/build authorities.
• Compile/typecheck/lint/native readiness and Rust gates pass after alignment.
• Affected packaged desktop plugin/runtime workflows are smoke-tested on relevant platforms.
• Updater/signature behavior is re-qualified if updater dependencies move.
• Any MSRV impact is reconciled through toolchain(rust): define deterministic build toolchain, explicit MSRV policy and Core/Tauri compatibility lanes #572 rather than silently changing compiler policy.
• [Bug]: Sluggishness? (.deb) #332 lifecycle evidence is updated if an upstream Tauri update materially changes known behavior.
• No R-15/Qt/Core feature implementation is bundled into Tauri dependency alignment.
• A bounded future Tauri 2.x maintenance policy exists through formal Tauri retirement.

Non-goals

• making Tauri perfect before Qt work;
• implementing Qt;
• migrating renderer-neutral Core authority;
• building new Tauri-only architecture;
• upgrading to a future Tauri major automatically;
• adding plugin features simply because newer releases expose them;
• weakening security/capabilities to ease upgrades;
• combining unrelated frontend/toolchain modernization into one PR.

[qnbs]

Fresh evidence 2026-09-06: current manifests still resolve JS @tauri-apps/api ^2.11.1, CLI ^2.11.4, Rust tauri 2.10.3, tauri-build 2.5.6, and broad plugin 2 ranges. Keep #573 P2 as the existing owner; do not couple this transitional alignment to #553, R15, or Qt.

[qnbs]

Status reconciliation — 2026-09-10

Two important parts of this issue's original risk picture have now been mechanically improved and should be treated as landed evidence, not future work:

1. Paired npm/Rust Tauri plugin drift is now guarded before ordinary CI convergence. PR fix(desktop): align Tauri plugin Rust/npm versions, add version-parity CI guard #678 aligned the mismatched plugin versions that broke the v1.28.5 desktop release and added scripts/check-tauri-plugin-versions.mjs, wired into the repository's validation path. The corrected v1.28.6 release subsequently built successfully across the supported desktop matrix.
2. Release-time parity now has an early preflight. PR fix(ci): close the Tauri release-prevention delta after #678/v1.28.5 #684 added a cheap parity-preflight before the expensive Tauri bundle matrix. The attempted Dependabot cross-ecosystem grouping approach was investigated and deliberately rejected as unsafe/unproven; npm and Cargo updates therefore remain separate, with same-PR reconciliation required whenever paired plugin compatibility demands it.

Scope remaining in #573

This issue should stay open, but its remaining purpose is now narrower:

• complete/current JS + Rust Tauri ecosystem inventory;
• classify intentional vs accidental version/range skew beyond the already-guarded paired-plugin major/minor contract;
• define/document the bounded transitional Tauri 2.x update/pin policy;
• reconcile any real MSRV implications through toolchain(rust): define deterministic build toolchain, explicit MSRV policy and Core/Tauri compatibility lanes #572;
• preserve packaged evidence for updates that touch runtime/build/updater behavior.

Do not redo the #678 parity checker or #684 release-preflight work. Do not introduce multi-ecosystem Dependabot coupling unless a future mechanism can be independently proven safe and deterministic. #332, #445/R-15, #553, Qt, and renderer-neutral Core authority remain separate owners.