Upgraded Tauri to v2.12.5 and fixed the zip security alerts (#1134)

.github/workflows/build-and-release.yml

@@ -54,7 +54,7 @@ env:
   # The Tauri CLI which bundles the app, exactly this version on every platform. Keep it at the minor
   # version of the tauri crate in runtime/Cargo.toml. The version also names the cache of the CLI, so
   # changing it installs the new CLI once on each platform and caches it from then on:
-  TAURI_CLI_VERSION: "2.11.5"
+  TAURI_CLI_VERSION: "2.12.4"
 
 jobs:
   determine_run_mode:

app/MindWork AI Studio/wwwroot/changelog/v26.11.1.md

@@ -1 +1,4 @@
 # v26.11.1, build 260 (2026-11-xx xx:xx UTC)
+- Fixed AI Studio becoming unusable when an update failed after its download. The app now restarts with the version you have installed, so you can simply try the update again.
+- Upgraded several libraries to improve security.
+- Upgraded Tauri to v2.12.5.

documentation/Build.md

@@ -17,7 +17,7 @@ Therefore, we cannot provide a static list here that is valid for all Linux syst
 Regardless of whether you want to build the app locally for yourself (not trusting the pre-built binaries) or test your changes before creating a PR, you have to run the following commands at least once:
 
 1. Open a terminal.
-2. Install the Tauri CLI by running `cargo install tauri-cli --version 2.11.0 --locked`.
+2. Install the Tauri CLI by running `cargo install tauri-cli --version 2.12.4 --locked`.
 3. Navigate to the `/app/Build` directory within the repository.
 4. Run `dotnet run build` to build the entire app.
 

runtime/Cargo.toml

@@ -6,14 +6,14 @@ description = "MindWork AI Studio"
 authors = ["Thorsten Sommer"]
 
 [build-dependencies]
-tauri-build = { version = "2.6.3", features = [] }
+tauri-build = { version = "2.7.4", features = [] }
 
 [dependencies]
-tauri = { version = "2.11.5", features = [] }
-tauri-plugin-window-state = { version = "2.4.1" }
-tauri-plugin-shell = "2.3.5"
-tauri-plugin-dialog = "2.7.1"
-tauri-plugin-opener = "2.5.4"
+tauri = { version = "2.12.5", features = [] }
+tauri-plugin-window-state = { version = "2.5.0" }
+tauri-plugin-shell = "2.6.0"
+tauri-plugin-dialog = "2.8.4"
+tauri-plugin-opener = "2.7.2"
 tauri-plugin-single-instance = "2"
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.150"
@@ -58,7 +58,7 @@ symphonia = { version = "0.6", default-features = false, features = ["aac", "aif
 ropus = "=0.12.18"
 rubato = { version = "4", default-features = false, features = ["fft_resampler"] }
 webm-iterable = "0.6.4"
-calamine = "0.36.0"
+calamine = "0.37.0"
 pdfium-render = "0.9.1"
 sys-locale = "0.3.2"
 whoami = "2.1.2"
@@ -90,11 +90,22 @@ tower = { version = "0.5.2", features = ["util"] }
 #        on this crate in version 0.1.2, so the patch stays relevant: https://github.com/asimihsan/permutation-iterator-rs/pull/14
 permutation_iterator = { git = "https://github.com/SommerEngineering/permutation-iterator-rs.git", rev = "76836ed316d18dfef530ba908f58481c343e80d7" }
 
+# Issue: docx-to-md 0.1.0 and pptx-to-md 1.0.0 require zip 8, which is affected by several security advisories, among them
+#        GHSA-m665-v7pm-7grj. Our forks upgrade both crates to zip 9 and limit pptx-to-md to the deflate compression.
+# State: We opened PRs for both crates: https://github.com/nilskruthoff/docx-parser/pull/6 and
+#        https://github.com/nilskruthoff/pptx-parser/pull/49. Remove these patches once both crates are released with zip 9.
+docx-to-md = { git = "https://github.com/SommerEngineering/docx-parser.git", rev = "3434bd405fc95a6a4f5de1d09c74dfd27a409996" }
+pptx-to-md = { git = "https://github.com/SommerEngineering/pptx-parser.git", rev = "540af00586d122c192093f6c42991ce015a67223" }
+
 [target.'cfg(target_os = "windows")'.dependencies]
 windows-registry = "0.6.1"
 windows-native-keyring-store = "1.1.0"
-windows = { version = "=0.61.3", features = ["ApplicationModel_DataTransfer", "Foundation", "Foundation_Collections", "Storage", "Storage_Streams", "Win32_Foundation", "Win32_System_WinRT", "Win32_UI_Shell"] }
-windows-collections = "=0.2.0"
+
+# The share sheet hands the window handle it gets from Tauri to the Windows API of this crate. Both
+# sides must use the same version of `windows`, otherwise the handle types differ and the build fails
+# on Windows. Keep this pin, and `windows-collections` with it, at the version Tauri uses.
+windows = { version = "=0.62.2", features = ["ApplicationModel_DataTransfer", "Foundation", "Foundation_Collections", "Storage", "Storage_Streams", "Win32_Foundation", "Win32_System_WinRT", "Win32_UI_Shell"] }
+windows-collections = "=0.3.2"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 apple-native-keyring-store = { version = "1.0.0", features = ["keychain"] }
@@ -110,7 +121,7 @@ webkit2gtk = { version = "2.0.2", features = ["v2_8"] }
 
 [target.'cfg(not(any(target_os = "android", target_os = "ios")))'.dependencies]
 tauri-plugin-global-shortcut = "2"
-tauri-plugin-updater = "2.10.1"
+tauri-plugin-updater = "2.14.1"
 
 [features]
 custom-protocol = ["tauri/custom-protocol"]

runtime/src/app_window.rs

@@ -765,6 +765,11 @@ pub async fn install_update() {
     match cloned_response_option {
         Some(update_response) => {
             info!(Source = "Tauri"; "Updater: update is pending!");
+
+            // Once the download is complete, the .NET server and Qdrant Edge stop so that the installer
+            // can replace their files. When the update fails after that, e.g., because the installer
+            // cannot start, the app would remain without both. Restarting it brings them back.
+            let mut servers_stopped = false;
             let result = update_response.download_and_install(
                 |chunk_length, _content_length| {
                     trace!(Source = "Tauri"; "Updater: downloading chunk of {chunk_length} bytes");
@@ -776,6 +781,7 @@ pub async fn install_update() {
                     if is_prod() {
                         stop_dotnet_server();
                         stop_qdrant_edge_database();
+                        servers_stopped = true;
                     } else {
                         warn!(Source = "Tauri"; "Development environment detected; do not stop the .NET server.");
                     }
@@ -799,6 +805,14 @@ pub async fn install_update() {
                 }
                 Err(e) => {
                     warn!(Source = "Tauri"; "Updater: failed to update: {e}");
+                    if servers_stopped {
+                        warn!(Source = "Tauri"; "The .NET server and Qdrant Edge are already stopped; try to restart the app now...");
+                        if let Some(handle) = app_handle {
+                            handle.restart();
+                        } else {
+                            warn!(Source = "Tauri"; "Cannot restart after the failed update: main window not available.");
+                        }
+                    }
                 }
             }
         },

runtime/src/share_sheet.rs

@@ -128,7 +128,7 @@ async fn share_file_on_platform(_path: PathBuf) -> Result<(), ShareFailure> {
 
 #[cfg(windows)]
 async fn share_file_on_platform(path: PathBuf) -> Result<(), ShareFailure> {
-    use std::cell::RefCell;
+    use std::cell::{Cell, RefCell};
     use std::time::{Duration, Instant};
     use log::{debug, warn};
     use windows::ApplicationModel::DataTransfer::{DataPackage, DataRequestedEventArgs, DataTransferManager, ShareCompletedEventArgs};
@@ -151,7 +151,7 @@ async fn share_file_on_platform(path: PathBuf) -> Result<(), ShareFailure> {
     fn provide_shared_file(arguments: &DataRequestedEventArgs, path: &str) -> windows::core::Result<()> {
         let request = arguments.Request()?;
         let lookup_started = Instant::now();
-        let file = StorageFile::GetFileFromPathAsync(&HSTRING::from(path))?.get()?;
+        let file = StorageFile::GetFileFromPathAsync(&HSTRING::from(path))?.join()?;
         let lookup_duration = lookup_started.elapsed();
         if lookup_duration > DATA_PACKAGE_DEADLINE {
             warn!(Source = "Share sheet"; "Looking up the shared file took {} ms, but Windows allows only {} ms to provide the data.", lookup_duration.as_millis(), DATA_PACKAGE_DEADLINE.as_millis());
@@ -231,7 +231,10 @@ async fn share_file_on_platform(path: PathBuf) -> Result<(), ShareFailure> {
             // that lock.
             //
             let share_started = Instant::now();
-            let mut data_requested = Some(data_requested_sender);
+
+            // Windows accepts only handlers which do not change what they captured, yet the first
+            // request has to take the sender. The cell allows that through a shared reference:
+            let data_requested = Cell::new(Some(data_requested_sender));
             let handler = TypedEventHandler::<DataTransferManager, DataRequestedEventArgs>::new(move |_, arguments| {
                 let Some(arguments) = arguments.as_ref() else {
                     return Ok(());