Upgraded Tauri to v2.12.5 and fixed the zip security alerts (#1134)

runtime/Cargo.toml

@@ -6,14 +6,14 @@ description = "MindWork AI Studio"
 authors = ["Thorsten Sommer"]
 
 [build-dependencies]
-tauri-build = { version = "2.6.3", features = [] }
+tauri-build = { version = "2.7.4", features = [] }
 
 [dependencies]
-tauri = { version = "2.11.5", features = [] }
-tauri-plugin-window-state = { version = "2.4.1" }
-tauri-plugin-shell = "2.3.5"
-tauri-plugin-dialog = "2.7.1"
-tauri-plugin-opener = "2.5.4"
+tauri = { version = "2.12.5", features = [] }
+tauri-plugin-window-state = { version = "2.5.0" }
+tauri-plugin-shell = "2.6.0"
+tauri-plugin-dialog = "2.8.4"
+tauri-plugin-opener = "2.7.2"
 tauri-plugin-single-instance = "2"
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.150"
@@ -58,7 +58,7 @@ symphonia = { version = "0.6", default-features = false, features = ["aac", "aif
 ropus = "=0.12.18"
 rubato = { version = "4", default-features = false, features = ["fft_resampler"] }
 webm-iterable = "0.6.4"
-calamine = "0.36.0"
+calamine = "0.37.0"
 pdfium-render = "0.9.1"
 sys-locale = "0.3.2"
 whoami = "2.1.2"
@@ -90,11 +90,22 @@ tower = { version = "0.5.2", features = ["util"] }
 #        on this crate in version 0.1.2, so the patch stays relevant: https://github.com/asimihsan/permutation-iterator-rs/pull/14
 permutation_iterator = { git = "https://github.com/SommerEngineering/permutation-iterator-rs.git", rev = "76836ed316d18dfef530ba908f58481c343e80d7" }
 
+# Issue: docx-to-md 0.1.0 and pptx-to-md 1.0.0 require zip 8, which is affected by several security advisories, among them
+#        GHSA-m665-v7pm-7grj. Our forks upgrade both crates to zip 9 and limit pptx-to-md to the deflate compression.
+# State: We opened PRs for both crates: https://github.com/nilskruthoff/docx-parser/pull/6 and
+#        https://github.com/nilskruthoff/pptx-parser/pull/49. Remove these patches once both crates are released with zip 9.
+docx-to-md = { git = "https://github.com/SommerEngineering/docx-parser.git", rev = "3434bd405fc95a6a4f5de1d09c74dfd27a409996" }
+pptx-to-md = { git = "https://github.com/SommerEngineering/pptx-parser.git", rev = "540af00586d122c192093f6c42991ce015a67223" }
+
 [target.'cfg(target_os = "windows")'.dependencies]
 windows-registry = "0.6.1"
 windows-native-keyring-store = "1.1.0"
-windows = { version = "=0.61.3", features = ["ApplicationModel_DataTransfer", "Foundation", "Foundation_Collections", "Storage", "Storage_Streams", "Win32_Foundation", "Win32_System_WinRT", "Win32_UI_Shell"] }
-windows-collections = "=0.2.0"
+
+# The share sheet hands the window handle it gets from Tauri to the Windows API of this crate. Both
+# sides must use the same version of `windows`, otherwise the handle types differ and the build fails
+# on Windows. Keep this pin, and `windows-collections` with it, at the version Tauri uses.
+windows = { version = "=0.62.2", features = ["ApplicationModel_DataTransfer", "Foundation", "Foundation_Collections", "Storage", "Storage_Streams", "Win32_Foundation", "Win32_System_WinRT", "Win32_UI_Shell"] }
+windows-collections = "=0.3.2"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 apple-native-keyring-store = { version = "1.0.0", features = ["keychain"] }
@@ -110,7 +121,7 @@ webkit2gtk = { version = "2.0.2", features = ["v2_8"] }
 
 [target.'cfg(not(any(target_os = "android", target_os = "ios")))'.dependencies]
 tauri-plugin-global-shortcut = "2"
-tauri-plugin-updater = "2.10.1"
+tauri-plugin-updater = "2.14.1"
 
 [features]
 custom-protocol = ["tauri/custom-protocol"]