Tauri release notes, breaking changes, and upgrade notes.
Smaller, faster, more secure desktop and mobile apps StackPulse turns upstream changelogs into scannable summaries with risky changes, deprecations, migration notes, and source links.
This release introduces several new features, including improved thread management and plugin cleanup hooks, while addressing breaking changes related to plugin concurrency and method renaming.
affected
Developers using Tauri plugins or thread management features are affected by these changes.
action
Update your code to use the new `Manager` methods and ensure plugin hooks comply with the new concurrency requirements.
release_signals
-Plugin hooks now require `Fn + Send + Sync` closures instead of `FnMut + Send`.
This release includes updates from Tauri 2.12 and addresses several unmaintained dependencies with security advisories. No new features or breaking changes were introduced.
affected
Users relying on unmaintained dependencies (fxhash, paste, rustls-pemfile, rustybuzz, ttf-parser) may need to migrate to maintained alternatives.
action
Review and update dependencies to replace unmaintained crates with maintained alternatives.
release_signals
!fxhash - no longer maintained (RUSTSEC-2025-0057)
!paste - no longer maintained (RUSTSEC-2024-0436)
!rustls-pemfile is unmaintained (RUSTSEC-2025-0134)
Tauri v2.12.0 introduces several new features including navigation restrictions, directory overrides, and app exit functionality. It also addresses security concerns with unmaintained crates and updates Gradle requirements for Android projects.
affected
Developers using Tauri for app development are affected by new features and security updates.
action
Update to Tauri v2.12.0 to utilize new features and ensure security compliance.
This release introduces several new features including enhanced navigation controls, directory overrides, and Windows-specific configurations. It also addresses minor bugs and deprecates the `STATIC_VCRUNTIME` environment variable.
affected
Developers using Tauri for building applications, especially those needing to manage app directories, navigation limits, or Windows-specific configurations, are affected.
action
Review the new features and configurations to leverage enhanced capabilities, especially for Windows-specific settings and navigation controls.
release_signals
!Unmaintained crates identified: fxhash, paste, rustls-pemfile, rustybuzz, ttf-parser. No immediate security vulnerabilities reported, but maintenance status should be monitored.
This release introduces new features for CEF runtime management and profile isolation, along with a breaking change in error handling for window creation. It also updates several dependencies and fixes a version reporting issue.
affected
Applications using `tauri_runtime::Error::CreateWindow` may need to update error handling due to the breaking change.
action
Update error handling for `tauri_runtime::Error::CreateWindow` if used.
release_signals
-`tauri_runtime::Error::CreateWindow` now carries the underlying error (`CreateWindow(Box<dyn std::error::Error + Send + Sync>)`), like `CreateWebview`.
!fxhash - no longer maintained (RUSTSEC-2025-0057)
This alpha release introduces breaking changes to macOS/iOS webview accessors and window creation error handling. It also updates several dependencies and includes security notes about unmaintained crates.
affected
Developers using macOS/iOS webview accessors or handling window creation errors are affected by the breaking changes.
action
Update code to use `*const c_void` for webview accessors and handle the new `CreateWindow` error type.
release_signals
-macOS and iOS platform webview accessors (`Webview::inner`, `Webview::controller`, `Webview::ns_window`, `Webview::view_controller`) and the fields of `IosWebviewHandle` are now `*const c_void` instead of `*mut c_void`, since the pointers are borrowed from ObjC `Retained` handles and must not be mutated through.
This alpha release of Tauri v3 includes several breaking API changes, primarily around plugin initialization and the Invoke API. It also updates multiple dependencies to their alpha.1 versions.
affected
Developers using Tauri plugins or the `Invoke` API are affected by breaking changes.
action
Update plugin code to use the new API names and types, and replace deprecated `Invoke` methods with `Manager::state`.
release_signals
-Renamed `plugin::Builder::js_init_script` to `initialization_script` and `js_init_script_on_all_frames` to `initialization_script_on_all_frames`.
-`Plugin::initialization_script` now returns `Option<InitializationScript>` instead of `Option<String>`, replacing the interim `Plugin::initialization_script_2`.
This release includes breaking changes for macOS and iOS webview accessors and error handling, along with updates to dependencies. Several dependencies are marked as unmaintained.
affected
Developers using macOS and iOS platform webview accessors or handling `tauri_runtime::Error::CreateWindow` are affected.
action
Update code to use `*const c_void` for webview accessors and handle the new `CreateWindow` error type.
release_signals
-macOS and iOS platform webview accessors (`Webview::inner`, `Webview::controller`, `Webview::ns_window`, `Webview::view_controller`) and the fields of `IosWebviewHandle` are now `*const c_void` instead of `*mut c_void`, since the pointers are borrowed from ObjC `Retained` handles and must not be mutated through.
This alpha release of tauri-utils v3.0.0 includes a breaking change to the NSIS installer icon configuration and updates several dependencies with security advisories.
affected
Users relying on the old kebab-case alias `install-icon` for NSIS installer icons will need to update their configuration to `installer-icon`.
action
Update any configurations using `install-icon` to use `installer-icon` instead.
release_signals
-The kebab-case alias of `bundle > windows > nsis > installerIcon` is now `installer-icon` instead of the mismatched `install-icon`.
!fxhash - no longer maintained (RUSTSEC-2025-0057)
!paste - no longer maintained (RUSTSEC-2024-0436)
tauri-cli-v2.11.5highsecuritySep 19, 2026
tauri-cli v2.11.5
This release focuses on security improvements, particularly in the updater plugin, ensuring signed artifacts are bound to their specific versions.
affected
Users relying on the updater plugin for secure version updates are affected.
action
Enable `requireSignedVersion` in the updater plugin configuration to enforce version binding.
release_signals
!Added version binding in updater signatures to ensure signed artifacts match their announced versions. Enable `requireSignedVersion` in the updater plugin configuration to enforce this.
This release introduces a security fix for the updater plugin, ensuring that signed artifacts are bound to their specific release version.
affected
Users relying on the updater plugin for version management are affected by this security fix.
action
Enable `requireSignedVersion` in the updater plugin configuration to enforce version binding.
release_signals
!Record the app version in the trusted comment of updater signatures to ensure a signed artifact is bound to the version it was released as. Enable `requireSignedVersion` in the updater plugin configuration to enforce this.
This release focuses on security fixes and dependency updates, particularly addressing vulnerabilities in the IPC queue handling and updating unmaintained crates.
affected
Users relying on IPC queue handling or affected unmaintained crates are impacted.
action
Upgrade to version 2.11.6 to mitigate security risks.
release_signals
!Fixed GHSA-w28w-mhc8-qvjv by binding channel data IPC queue entries to the webview they were created for, preventing unauthorized access.
This release includes a bug fix for debug formatting in `WindowsStore` and `ActiveTraceSpanStore` and updates dependencies to `tauri@3.0.0-alpha.1`. It also lists several unmaintained dependencies with security advisories.
affected
Users of `WindowsStore` and `ActiveTraceSpanStore` may be affected by the debug formatting fix.
action
Update to the latest version to benefit from the bug fixes.
release_signals
!fxhash - no longer maintained (RUSTSEC-2025-0057)
!paste - no longer maintained (RUSTSEC-2024-0436)
!rustls-pemfile is unmaintained (RUSTSEC-2025-0134)
This release introduces significant changes to the Tauri runtime, including the migration of Android binding macros and runtime-specific APIs to the `tauri-runtime-wry` crate. It also includes breaking changes related to feature flags and runtime-specific extensions.
affected
Developers using Tauri for Android apps or relying on runtime-specific APIs will need to update their code.
action
Update dependencies and modify code to use the new runtime-specific APIs and feature flags.
release_signals
-The `devtools`, `macos-private-api`, and `unstable` features must now be enabled on the runtime crate (`tauri-runtime-wry` or `tauri-runtime-cef`).
-Runtime-specific APIs moved from the `tauri` crate to extension traits in the runtime crates.
-
Plugin methods like `window_created` and `on_event` now take `&self` instead of `&mut self`.
-Removed `objc-exception` feature flag, which was a no-op since 2.3.0.
-Renamed `TrayIcon::with_inner_tray_icon` to `TrayIcon::with_inner_blocking`.
-Removed position and size parameters from `Window::add_child` API.
+Added `app > appDirectoriesOverride` config to override directories returned by path APIs.
+Added `exit` function to `@tauri-apps/api/app` for exiting the app without requiring a plugin.
+Added `Webview::convert_file_src` and `WebviewWindow::convert_file_src` for Rust equivalent of JavaScript `convertFileSrc`.
+Added `Builder::activate_ignoring_other_apps` on macOS to control app activation at launch.
migration_steps1 steps
01Update Gradle to version 8.13 if using Kotlin 2.x, delete `src-tauri/gen/android/gradle/wrapper/gradle-wrapper.properties` and re-run `tauri android init` to update.
`tauri_runtime::Error::CreateWindow` now carries the underlying error (`CreateWindow(Box<dyn std::error::Error + Send + Sync>)`), like `CreateWebview`.
!fxhash - no longer maintained (RUSTSEC-2025-0057)
!paste - no longer maintained (RUSTSEC-2024-0436)
!rustls-pemfile is unmaintained (RUSTSEC-2025-0134)
Renamed `Plugin::extend_api` to `Plugin::run_invoke_handler`.
-Removed the deprecated `Invoke::state` and `Invoke::state_ref` methods; use `Manager::state` on `Invoke::webview_ref()` instead. `tauri::StateManager` is no longer exported.
!fxhash - no longer maintained (RUSTSEC-2025-0057)
!paste - no longer maintained (RUSTSEC-2024-0436)
!rustls-pemfile is unmaintained (RUSTSEC-2025-0134)
`tauri_runtime::Error::CreateWindow` now carries the underlying error (`CreateWindow(Box<dyn std::error::Error + Send + Sync>)`), like `CreateWebview`.
!fxhash - no longer maintained (RUSTSEC-2025-0057)
!paste - no longer maintained (RUSTSEC-2024-0436)
!rustls-pemfile is unmaintained (RUSTSEC-2025-0134)