[luvs01]

Summary

This updates the Windows updater dependency chain for the zip advisory tracked in source PR luvs01/opencodex#790 and aligns the declared Rust minimum with the selected Tauri crates. The original dependency work and unchanged source head 9ccd9b313b6a5d6650e71ede2336cd1a329f3333 are preserved.

• Update the Windows updater dependency chain to tauri-plugin-updater =2.14.1, tauri =2.12.5, tauri-build =2.7.4, and tauri-utils =2.10.2. The lockfile resolves the original zip advisory with zip 9.1.3.
• Declare Rust 1.90, matching those pinned crates, and update the desktop structure document. The previous Rust 1.88 declaration could not build the selected dependencies.
• Integrate upstream dev at c618c77b1e81aa8952422e2d3657439ed6d5f8fe, retaining patched rustls 0.23.46 already landed through upstream build(deps): bump rustls from 0.23.45 to 0.23.46 in /desktop/src-tauri #7942. The original dependency update is preserved; no dependency was downgraded to reduce the diff. The delta against the recorded dev snapshot 63de499e is three files.

Verification

• Automated Codex security review did not complete: the payer account reached its usage limit (review status). This is neither a security pass nor a vulnerability finding; independent security/maintainer acceptance remains pending.

Current source head: 9ccd9b313b6a5d6650e71ede2336cd1a329f3333.

• Exact upstream Cross-platform CI 41176633675 passed (9 successful jobs / 12 scope or platform skips), as did Service lifecycle 41176633694. The desktop job completed Rust fmt/clippy/tests, Linux AppImage and deb builds, packaged keyring verification and Linux packaged-shell E2E. Skipped platforms and these Linux checks do not replace the signed Windows updater acceptance below.

• Windows x64, exact isolated Rust 1.90.0: cargo check --manifest-path desktop/src-tauri/Cargo.toml --locked passed with the actual prepared Windows sidecar, keyring and GUI resources.

• Native unit coverage: updater 16, CLI command construction 8, autostart command construction 3, plus registry recovery 1 and private ACL 5 under Windows BasicUser: 33 distinct passing tests. The elevated-token registry attempt was refused by the existing owner guard because its default owner was Administrators; the same test binary passed as BasicUser. The guard and ACL policy were not weakened.

• Official unsigned local build, bun desktop/scripts/build-local.ts -- -- --locked, produced both Windows release bundles below with Rust 1.90. The committed updater public key, endpoint and createUpdaterArtifacts: true remain unchanged; the official helper disables updater artifacts for this local invocation only.

• bun check --no-script --noEmit: 2,253 files; structure, privacy and file-size gates passed. Source and lockfile digests remained unchanged through the native build.

• Exact-head Cross-platform CI: 41156255102 passed on this exact head (14 successful jobs / 10 policy skips). Policy skips do not establish native Windows/macOS acceptance. Catalog async contracts 41156254959 passed. A full local proxy suite was not repeated for this dependency/MSRV change; focused native validation and current CI cover the changed path.

Local artifact	Bytes	SHA-256
OpenCodex_2.95.0_x64_en-US.msi	67,125,248	9525687bd086c8a65dbac73d3795b2fe29ac4b50aed22f64a790fcd11fffc9ca
OpenCodex_2.95.0_x64-setup.exe	50,009,619	461dccc77d4288d1710b4757189849a0c039a5311da1aa4389adf5c91508f779

Validation limits: build output passed, but the runner required controlled cleanup and its final receipt is not a clean native-job pass. These are unsigned local bundles, not a signed updater archive. No installed app was replaced or launched. Signed update discovery, extraction, installation and restart still require an approved signed test artifact/feed and an isolated Windows user or VM before release. Maintainer/security acceptance and Dependabot alert closure are separate.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Independent security/maintainer acceptance. The committed updater key, endpoint and security defaults remain unchanged; static scope/config review and native build evidence do not replace acceptance.
• Signed Windows updater installation and restart acceptance before release.
• Confirm the relevant Dependabot alerts close after this change lands.

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Summary by CodeRabbit

• Chores
  • Updated the desktop app’s underlying platform components to newer versions.
  • The desktop app now requires Rust 1.90 to build.
• Documentation
  • Updated the documented minimum Rust version to 1.90.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The desktop package now requires Rust 1.90 and pins updated versions of tauri-build, tauri, tauri-utils, and tauri-plugin-updater. The desktop shell documentation also states the Rust 1.90 minimum.

Changes: Desktop version updates

Layer / File(s)	Summary
Rust requirement and Tauri package pins desktop/src-tauri/Cargo.toml, structure/desktop-shell.md	The Cargo manifest raises the minimum Rust version from 1.88 to 1.90 and updates the pinned Tauri package versions. The documentation records the Rust 1.90 minimum.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested labels: chore

Suggested reviewers: lidge-j

Merge Risk: Minimal · previous review 9ccd9

No merge-blocking defect was identified. The signed Windows updater flow remains untested.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title names the two main changes: the updater bump to 2.14.1 and the Rust 1.90 alignment. The raw summary confirms both in desktop/src-tauri/Cargo.toml and structure/desktop-shell.md. The title is…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the two main changes: the updater bump to 2.14.1 and the Rust 1.90 alignment. The raw summary confirms both in desktop/src-tauri/Cargo.toml and structure/desktop-shell.md. The title is concise and specific. It omits the Tauri crate pin changes, but that is expected. The 'security(desktop)' prefix matches the stated purpose of the Windows updater dependency chain fix (zip 4.6.1 to zip 9.1.3).

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: lidge-jun/opencodex
• Branch: dev
• File: .coderabbit.yaml
• Commit: 63de499
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 16bdc426-3fdf-4041-9f20-2f77f8c122f7

Commits

Reviewing files that changed from the base of the PR and between 63de499 and 9ccd9b3.

Files ignored due to path filters: 1

• desktop/src-tauri/Cargo.lock is excluded by !**/*.lock

Files selected for processing: 2

• desktop/src-tauri/Cargo.toml
• structure/desktop-shell.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	⚠️ Failed 2026-10-31T06:49:18.328725Z We couldn’t complete this review. Comment @codex security review to try again.	9ccd9b3	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins.

[Ingwannu]

Scoped maintainer triage for exact head 9ccd9b313b6a5d6650e71ede2336cd1a329f3333.

The actual PR comparison is three files (Cargo manifest/lock and the owning desktop doc); a raw two-tip comparison with the newer dev version line is not this feature's delta. The dependency/MSRV change is explicit, and upstream Cross-platform run 41176633675 is green, including the Linux desktop-shell job. These results do not certify Windows updater installation or close Dependabot alerts.

The description correctly retains the incomplete automated review as incomplete, and distinguishes unsigned local Windows artifacts from a signed update. Independent dependency/updater-boundary acceptance remains pending as stated; I have not added a sponsorship waiver or claimed to complete that review. Keep signed feed discovery/extraction/install/restart acceptance as a release requirement, rather than requesting a new per-PR cross-platform dispatch. No native install, release, scan or alert closure was performed by this triage.

[luvs01]

Windows signed-updater acceptance evidence on the PR head (9ccd9b3, tauri-plugin-updater 2.14.1), run in a Windows Sandbox VM on 2026-11-02 — Path A from the acceptance plan (candidate 2.95.0 → official 2.96.0 over the real feed, no feed or key changes).

Verdict: PASS. The candidate app detected the official update, downloaded it, Ed25519-verified the signature, installed the MSI, and restarted as the official 2.96.0 build.

Receipt chain:

• Candidate install: 2.95.0 registered (product {C6D5A48B-B35B-4697-B8B3-154F68170C64}), msiexec log captured.
• Offer detection: app reported update 2.96.0 while the 2.95.0 process was running.
• Install: registered DisplayVersion 2.96.0 under a NEW product code {0D06F774-8C6B-4A3A-A40B-F986596193AA} — the MSI was actually swapped, not just reported.
• Relaunch: opencodex-desktop.exe FileVersion 2.96.0, SHA-256 99A0E2BA77C14DAA31B6BD15E7D9FA641D7071B604805A689591A4038310A4A1; bundled ocx proxy /healthz → status ok, version 2.96.0, port 10100.
• Settings/state preserved (.opencodex, com.opencodex.desktop data dirs); no duplicate service or scheduled task.
• Official target verified before install: MSI SHA-256 8c3977d3…, .sig verified against the committed updater pubkey (AC76B046EBEBF81). No Authenticode, as expected for the test-signing profile.

Environment note: the Sandbox base image ships without WebView2 Runtime, so the app ran with a copied runtime folder + WEBVIEW2_BROWSER_EXECUTABLE_FOLDER. The WebView2 error on update-restart is a sandbox artifact (the relaunched process does not inherit the env var), not a candidate defect. Operator actions were limited to approving the 2.96.0 version prompt and clicking install in the app UI.

Scope honestly bounded: this proves the PR''s updater 2.14.1 performs the real official-feed download + signature verify + MSI install + restart on Windows end to end. It does not prove the release/signing pipeline for a future patched build (Path C, maintainer-owned) or tamper/wrong-key rejection (Path B test-key harness). Evidence files retained locally under C:\CodexHot\ocx-8039-acceptance.

[lidge-jun]

Maintainer integration into dev (account lidge-jun) at head acea1f4ec9231e049c2465b4d308394f0ba803de.

security(desktop): bump the Tauri updater to 2.14.1 and align Rust 1.90. The lockfile move brings zip 9.1.3, which carries the fix for RUSTSEC-2026-0429 / GHSA-m665-v7pm-7grj.

• Exact-head required CI passed: ci, enforce-target, hygiene, test 1/4–4/4 (ci:full), plus desktop shell. The head is an empty commit over the dev-merged 40c83b673 (tree identical) so the full shards ran.
• Security review (gpt-6.1-terra, high), fresh final round PASS on this head: all 556 registry packages in the lockfile carry checksums and no git or other non-registry source was added; the updater still verifies the package signature against the configured public key both during download and before install; endpoints and pubkey unchanged; cargo metadata --locked exit 0.
• Changed files: desktop/src-tauri/Cargo.toml, desktop/src-tauri/Cargo.lock, structure/desktop-shell.md; no overlap with later dev commits. No unresolved threads or changes-requested reviews.

Thanks for the fix.