[rjwalters]

Patches Studio's Tokio and event-listener dependencies and backports the upstream GLib string-iterator fix. The original GLib iterator passes a shared reference as a mutable FFI output pointer, causing undefined behavior and an optimized-build crash (RUSTSEC-2024-0429). The vendored, checksum-verified 0.18.5 crate uses the upstream mutable-pointer fix while preserving Tauri's API requirements and all unrelated package choices.

Retains the original license, upstream tests and source hashes. Adds five optimized iterator regressions and Linux CI. Also corrects an unrelated upstream test's out-of-bounds slice access when checking its allocated NULL sentinel; the assertion remains, and no tests are skipped.

Validation: the original security regression still crashes after the test-only correction, while the production backport passes all 226 library tests and five security regressions. The integrated all-target dependency graph selects the vendored crate; locked all-feature/all-target application check, actionlint and audit pass. Audit reports zero vulnerability entries with no ignores; GLib's version-based unsoundness warning remains documented with source mitigation evidence. Tokio 1.53.3 and event-listener 5.4.2 remove RUSTSEC-2026-0386 and RUSTSEC-2026-0221.

Independent review, remote CI, merge, and verification of rebuilt application binaries remain separate steps.

[rjwalters]

Judge: APPROVED at exact head b007d449ec03236c46930da94602e67f7fa0c87f. This is an independent review, drafted by an agent session at the maintainer's request.

• Vendored glib 0.18.5: byte-for-byte equal to the published crate (archive sha256 233daaf6…, matching the base lockfile), except for three changes:

  • src/variant_iter.rs, identical to the upstream fix gtk-rs/gtk-rs-core@b5a4071 (RUSTSEC-2024-0429);
  • src/collections/strv.rs, a test-only NULL-sentinel read that stays inside the allocation;
  • Cargo.toml, a standalone [workspace].

  The additions are test-only lock, security docs and provenance, and the iterator regression tests.

• apps/studio/src-tauri:

  • [patch.crates-io] glib points at the vendored path. A locked, all-features cargo metadata resolves cleanly and selects it.
  • Lock deltas: tokio 1.52.3 → 1.53.3, event-listener 5.4.1 → 5.4.2 (drops concurrent-queue, matching its index entry), and glib's registry source/checksum removed. All checksums match the crates.io index, and nothing is yanked.

• Audit, base vs head: no vulnerabilities before or after. Removes RUSTSEC-2026-0221 (event-listener) and RUSTSEC-2026-0386 (tokio), and adds none. RUSTSEC-2024-0429 is still reported because cargo-audit matches on version; the patched source is what is built.

• CI: the new Vendored GLib iterator safety job is green at this head.

Non-blocking: security.yml triggers push on main, but this repository's default branch is master, so the job won't run after merge. Worth a one-word follow-up.

Source only; this makes no claim about deployed or released binaries.

[rjwalters]

Judge: APPROVED at successor head 3064e2c1f89ecdf92dafb9eb299c90f12c56bbb3. This is an independent review, drafted by an agent session.

The diff from the previously approved b007d449 is one commit (3064e2c) and one line: the security.yml push trigger changes from main to master, the default branch. That resolves my earlier non-blocking note. Rust sources, manifests, locks and the vendored crate are unchanged, so the earlier verification carries over. The Vendored GLib iterator safety job is green at this head.