tauri-build-v3.0.0-alpha.0

<details>
<summary><em><h4>Cargo Audit</h4></em></summary>

```
Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1243 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (1217 crate dependencies)
Crate:     fxhash
Version:   0.2.1
Warning:   unmaintained
Title:     fxhash - no longer maintained
Date:      2025-09-05
ID:        RUSTSEC-2025-0057
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0057

Crate:     paste
Version:   1.0.15
Warning:   unmaintained
Title:     paste - no longer maintained
Date:      2024-10-07
ID:        RUSTSEC-2024-0436
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0436

Crate:     rustls-pemfile
Version:   2.2.0
Warning:   unmaintained
Title:     rustls-pemfile is unmaintained
Date:      2025-11-28
ID:        RUSTSEC-2025-0134
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0134

Crate:     rustybuzz
Version:   0.20.1
Warning:   unmaintained
Title:     `rustybuzz` is unmaintained
Date:      2026-07-11
ID:        RUSTSEC-2026-0206
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0206

Crate:     ttf-parser
Version:   0.25.1
Warning:   unmaintained
Title:     `ttf-parser` is unmaintained
Date:      2026-06-28
ID:        RUSTSEC-2026-0192
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0192

warning: 5 allowed warnings found
```

</details>

## [3.0.0-alpha.0]

### New Features

- [`364a0e711`](https://www.github.com/tauri-apps/tauri/commit/364a0e711d8c1e5f2ad9439feff498055f5065c7) ([#15882](https://www.github.com/tauri-apps/tauri/pull/15882)) `tauri-build` no longer copies the configured resources to the cargo target directory; on desktop, unbundled apps (`tauri dev` / `cargo run`) now resolve resources at runtime from their source paths instead. This means editing a resource file no longer triggers a full application rebuild, and changes to plain relative resources are picked up live by the running app.
    
    - When all configured resources are plain relative paths (e.g. `"assets/*"`), the resource directory resolves to the directory containing `tauri.conf.json` and files are read directly from the sources.
    - When resources are remapped (map notation, `../` or absolute paths), the bundle layout is mirrored next to the executable on the first resource directory access of each run.
    
    The `bundle > resources` configuration is now part of the config embedded by `generate_context!`, where it was previously stripped.
- [`33144467c`](https://www.github.com/tauri-apps/tauri/commit/33144467cb85825efb9fdbf5b519e6dab35f2eb9) ([#15883](https://www.github.com/tauri-apps/tauri/pull/15883)) Add `tauri_build::try_build_context` and `ContextAttributes` for packages that expand `tauri::generate_context!` once and share the context with the rest of the workspace. It runs only what the context expansion consumes — config parsing with its rerun instructions, the `OUT_DIR` ACL artifacts and global API script list, the cfg aliases, and `TAURI_ENV_TARGET_TRIPLE` — and skips application artifact staging and executable-specific build configuration, which stay with the package that owns the binary.

### Enhancements

- [`65792f536`](https://www.github.com/tauri-apps/tauri/commit/65792f5364e34daaaf8cd612452f6dc0bc63a2bd) Plugin and app build scripts now write the autogenerated command permissions to `OUT_DIR` instead of the crate's `permissions/autogenerated` folder, so they no longer need to be committed at the crate level. This applies to plugin crates (`tauri-plugin`) and the application manifest (`tauri_build::AppManifest`); inlined plugins (`tauri_build::InlinedPlugin`) already wrote them to `OUT_DIR`. For plugin crates, the human-readable permission documentation (`reference.md`) is still generated in `permissions/autogenerated` so it stays recoverable.
    
    Added `tauri_utils::acl::build::collect_permission_files` and `tauri_utils::acl::build::define_permissions_from_files` to allow merging permission files from multiple directories into a single permission file list.

### Bug Fixes

- [`fb2dcae84`](https://www.github.com/tauri-apps/tauri/commit/fb2dcae84cba9af15cfd4bf7c01d5ebef6292d2d) Support cargo's build-dir layout (the default since Rust 1.100), which moves build script output from `build/<pkg>-<hash>` to `build/<pkg>/<hash>`: fixed the target directory resolution used for staging external binaries and frameworks, and the `WebView2Loader.dll` lookup for `windows-gnu` targets. When `build.build-dir` is set through the `CARGO_BUILD_BUILD_DIR` environment variable, staged artifacts now follow the executable into the target directory instead of the build directory.

### Performance Improvements

- [`fb7bdd95b`](https://www.github.com/tauri-apps/tauri/commit/fb7bdd95be319d70a1097d285bb7b170562339f2) Reduce the size of the resolved ACL embedded in the app by storing the autogenerated command permissions as a `commands` list on the plugin/app manifest instead of two explicit permissions (`allow-$command` and `deny-$command`) per command. The `allow-$command`/`deny-$command` permissions are now materialized on demand when resolving the ACL.
    
    The application manifest also gains implicit `allow-*` and `deny-*` permissions that allow or deny **all** of its commands through a single resolved entry, so capabilities no longer need to list every command individually.

### What's Changed

- [`c9277f3c0`](https://www.github.com/tauri-apps/tauri/commit/c9277f3c0c24518a7ab7d7d1f2489e004b1597f7) Set MSRV to 1.95.
- [`19929799f`](https://www.github.com/tauri-apps/tauri/commit/19929799f42398a6e85adb00ae02f2e7fe46d214) First v3 alpha release!

### Dependencies

- Upgraded to `tauri-utils@3.0.0-alpha.0`
- Upgraded to `tauri-codegen@3.0.0-alpha.0`

### Breaking Changes

- [`1e5ba7b53`](https://www.github.com/tauri-apps/tauri/commit/1e5ba7b53dfb3da97f372b646f15853e5ba0e1a8) ([#15985](https://www.github.com/tauri-apps/tauri/pull/15985)) The CEF runtime is now detected through the `tauri-runtime-cef` dependency of the application (the `DEP_TAURI_RUNTIME_CEF_RUNTIME` env var it exports to the app's build script) instead of the removed `cef` feature of `tauri`.

<details>
<summary><em><h4>Cargo Publish</h4></em></summary>

```
Updating crates.io index
   Packaging tauri-build v3.0.0-alpha.0 (/home/runner/work/tauri/tauri/crates/tauri-build)
    Updating crates.io index
    Packaged 16 files, 156.4KiB (42.6KiB compressed)
   Verifying tauri-build v3.0.0-alpha.0 (/home/runner/work/tauri/tauri/crates/tauri-build)
 Downloading crates ...
  Downloaded dirs v6.0.0
  Downloaded tauri-winres v0.3.6
  Downloaded cargo_toml v1.0.1
  Downloaded option-ext v0.2.0
  Downloaded dirs-sys v0.5.0
  Downloaded embed-resource v3.0.11
   Compiling find-msvc-tools v0.1.12
   Compiling shlex v2.0.1
   Compiling rustc_version v0.4.1
   Compiling option-ext v0.2.0
   Compiling dirs-sys v0.5.0
   Compiling cc v1.4.5
   Compiling tauri-utils v3.0.0-alpha.0
   Compiling dirs v6.0.0
   Compiling cargo_toml v1.0.1
   Compiling heck v0.5.0
   Compiling embed-resource v3.0.11
   Compiling tauri-winres v0.3.6
   Compiling tauri-build v3.0.0-alpha.0 (/home/runner/work/tauri/tauri/target/package/tauri-build-3.0.0-alpha.0)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 9.24s
   Uploading tauri-build v3.0.0-alpha.0 (/home/runner/work/tauri/tauri/crates/tauri-build)
    Uploaded tauri-build v3.0.0-alpha.0 to registry `crates-io`
note: waiting for tauri-build v3.0.0-alpha.0 to be available at registry `crates-io`
help: you may press ctrl-c to skip waiting; the crate should be available shortly
   Published tauri-build v3.0.0-alpha.0 at registry `crates-io`
```

</details>