tauri-v3.0.0-alpha.0

<details>
<summary><em><h4>Cargo Audit</h4></em></summary>

```
Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1243 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (1217 crate dependencies)
Crate:     fxhash
Version:   0.2.1
Warning:   unmaintained
Title:     fxhash - no longer maintained
Date:      2025-09-05
ID:        RUSTSEC-2025-0057
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0057

Crate:     paste
Version:   1.0.15
Warning:   unmaintained
Title:     paste - no longer maintained
Date:      2024-10-07
ID:        RUSTSEC-2024-0436
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0436

Crate:     rustls-pemfile
Version:   2.2.0
Warning:   unmaintained
Title:     rustls-pemfile is unmaintained
Date:      2025-11-28
ID:        RUSTSEC-2025-0134
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0134

Crate:     rustybuzz
Version:   0.20.1
Warning:   unmaintained
Title:     `rustybuzz` is unmaintained
Date:      2026-07-11
ID:        RUSTSEC-2026-0206
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0206

Crate:     ttf-parser
Version:   0.25.1
Warning:   unmaintained
Title:     `ttf-parser` is unmaintained
Date:      2026-06-28
ID:        RUSTSEC-2026-0192
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0192

warning: 5 allowed warnings found
```

</details>

## [3.0.0-alpha.0]

### New Features

- [`1e5ba7b53`](https://www.github.com/tauri-apps/tauri/commit/1e5ba7b53dfb3da97f372b646f15853e5ba0e1a8) ([#15985](https://www.github.com/tauri-apps/tauri/pull/15985)) The `tauri::android_binding!` macro moved to `tauri_runtime_wry::android_binding!`, and `#[tauri::mobile_entry_point]` expands to it, so Android apps must depend on `tauri-runtime-wry`. `tauri::handle_android_plugin_response` and `tauri::send_channel_data` are exposed on Android for other runtimes to implement their own binding.
- [`364a0e711`](https://www.github.com/tauri-apps/tauri/commit/364a0e711d8c1e5f2ad9439feff498055f5065c7) ([#15882](https://www.github.com/tauri-apps/tauri/pull/15882)) `tauri-build` no longer copies the configured resources to the cargo target directory; on desktop, unbundled apps (`tauri dev` / `cargo run`) now resolve resources at runtime from their source paths instead. This means editing a resource file no longer triggers a full application rebuild, and changes to plain relative resources are picked up live by the running app.
    
    - When all configured resources are plain relative paths (e.g. `"assets/*"`), the resource directory resolves to the directory containing `tauri.conf.json` and files are read directly from the sources.
    - When resources are remapped (map notation, `../` or absolute paths), the bundle layout is mirrored next to the executable on the first resource directory access of each run.
    
    The `bundle > resources` configuration is now part of the config embedded by `generate_context!`, where it was previously stripped.

### Bug Fixes

- [`65b3b040a`](https://www.github.com/tauri-apps/tauri/commit/65b3b040a7248422e7b0820074c5fc70229216a7) The `tauri` custom protocol now resolves the asset path from the request URI path instead of stripping a hardcoded `tauri://localhost` prefix, so a runtime is free to define any custom scheme URL format in `Runtime::custom_scheme_url`.

### Performance Improvements

- [`fb7bdd95b`](https://www.github.com/tauri-apps/tauri/commit/fb7bdd95be319d70a1097d285bb7b170562339f2) Reduce the size of the resolved ACL embedded in the app by storing the autogenerated command permissions as a `commands` list on the plugin/app manifest instead of two explicit permissions (`allow-$command` and `deny-$command`) per command. The `allow-$command`/`deny-$command` permissions are now materialized on demand when resolving the ACL.
    
    The application manifest also gains implicit `allow-*` and `deny-*` permissions that allow or deny **all** of its commands through a single resolved entry, so capabilities no longer need to list every command individually.

### What's Changed

- [`c9277f3c0`](https://www.github.com/tauri-apps/tauri/commit/c9277f3c0c24518a7ab7d7d1f2489e004b1597f7) Set MSRV to 1.95.
- [`19929799f`](https://www.github.com/tauri-apps/tauri/commit/19929799f42398a6e85adb00ae02f2e7fe46d214) First v3 alpha release!

### Dependencies

- Upgraded to `tauri-utils@3.0.0-alpha.0`
- Upgraded to `tauri-build@3.0.0-alpha.0`
- Upgraded to `tauri-macros@3.0.0-alpha.0`
- Upgraded to `tauri-runtime@3.0.0-alpha.0`

### Breaking Changes

- [`1e5ba7b53`](https://www.github.com/tauri-apps/tauri/commit/1e5ba7b53dfb3da97f372b646f15853e5ba0e1a8) ([#15985](https://www.github.com/tauri-apps/tauri/pull/15985)) The `devtools`, `macos-private-api` and `unstable` features must now be enabled on the runtime crate (`tauri-runtime-wry` or `tauri-runtime-cef`), which also enables them on `tauri`. Enabling them on `tauri` alone no longer enables them on the runtime.
- [`1e5ba7b53`](https://www.github.com/tauri-apps/tauri/commit/1e5ba7b53dfb3da97f372b646f15853e5ba0e1a8) ([#15985](https://www.github.com/tauri-apps/tauri/pull/15985)) Runtime-specific APIs moved from the `tauri` crate to extension traits in the runtime crates, which now depend on `tauri`:
    
    - `tauri_runtime_wry::{AppHandleWryExt, AppWryExt, WebviewWryExt, WebviewWindowBuilderWryExt, WebviewBuilderWryExt}` provide `create_tao_window`, `send_tao_window_event`, `wry_plugin`, `with_wry_webview`, `with_environment`, `with_related_view` and `with_webview_configuration`.
    - `tauri_runtime_cef::{WebviewCefExt, WebviewWindowBuilderCefExt, WebviewBuilderCefExt}` provide `send_dev_tools_message`, `on_dev_tools_protocol` and `browser_runtime_style`.
    - The traits are implemented both for the concrete runtime and for `tauri::DynRuntime`, returning `tauri_runtime::Error::RuntimeTypeMismatch` when the app runs on a different runtime.
    - The `tauri::tao` and `tauri::wry` re-exports were removed, use `tauri_runtime_wry::{tao, wry}`.
    - `tauri::webview::PlatformWebview::downcast_ref` was added to reach the runtime's webview type from `with_webview`, whatever the runtime generic in use.
- [`1e5ba7b53`](https://www.github.com/tauri-apps/tauri/commit/1e5ba7b53dfb3da97f372b646f15853e5ba0e1a8) ([#15985](https://www.github.com/tauri-apps/tauri/pull/15985)) The custom scheme URL format (`tauri://localhost` or `http://tauri.localhost`) is now defined by the runtime instead of the platform: `Runtime::custom_scheme_url` moved to `RuntimeHandle::custom_scheme_url(&self, scheme, https)`, and the `convertFileSrc` JavaScript API takes the format from the runtime.
    
    `tauri::test::MockRuntime` uses `tauri://localhost` on every platform, so tests that sent IPC requests from `http://tauri.localhost` on Windows and Android must use `tauri://localhost` instead.
- [`1e5ba7b53`](https://www.github.com/tauri-apps/tauri/commit/1e5ba7b53dfb3da97f372b646f15853e5ba0e1a8) ([#15985](https://www.github.com/tauri-apps/tauri/pull/15985)) Added the required `RuntimeHandle::webview_version` method, exposed as `App::webview_version` and `AppHandle::webview_version`. The `tauri::webview_version` function was removed since the version depends on the runtime in use.
- [`1e5ba7b53`](https://www.github.com/tauri-apps/tauri/commit/1e5ba7b53dfb3da97f372b646f15853e5ba0e1a8) ([#15985](https://www.github.com/tauri-apps/tauri/pull/15985)) The webview runtime is now selected when building the app instead of through Cargo features of the `tauri` crate. Applications depend on the runtime crate directly and pass its attributes to `tauri::Builder::runtime`:
    
    ```rust
    tauri::Builder::default()
      .runtime(tauri_runtime_wry::Wry::default()) // or `tauri_runtime_cef::Cef::default()`
      .run(tauri::generate_context!())
      .expect("error while running tauri application");
    ```
    
    - The `wry` and `cef` features were removed, along with the `x11`, `dbus` and `macos-proxy` features that were forwarded to the wry runtime.
    - The `tauri::Wry`, `tauri::WryHandle`, `tauri::Cef`, `tauri::CefHandle`, `tauri::CefDevToolsProtocol`, `tauri::CefRuntimeAttributes`, `tauri::run_cef_helper_process` and `tauri::CEF_API_VERSION_LAST` items were removed.
    - `tauri::Builder::default()` uses the new type-erased `tauri::DynRuntime`, which is also the default runtime type of `AppHandle`, `Window`, `Webview` and the other generic types, so they can still be used without naming the runtime. Building the app fails with `RuntimeNotConfigured` if no runtime was selected.
    - Static dispatch remains available with `tauri::Builder::<tauri_runtime_wry::WryRuntime>::new()`, whose `runtime` method takes the attributes of that runtime. The `runtime_init_attrs` builder method was merged into `runtime`.
- [`c8c75b1f7`](https://www.github.com/tauri-apps/tauri/commit/c8c75b1f7f43e7cb1e7d773ed2f6f96fad2fe975) ([#15787](https://www.github.com/tauri-apps/tauri/pull/15787)) The Linux GTK bindings are now selected by the new `gtk3` and `gtk4` features instead of being always on, so `tauri` can be built for either GTK version and compiles on Linux and BSD without any GTK dependency at all.
    
    - Runtime crates enable the right one for you: `tauri-runtime-wry` enables `gtk3` and `tauri-runtime-cef` enables `gtk4`. Apps and plugins that depend on `tauri` alone and use `Window::gtk_window`, `Window::default_vbox`, `WindowBuilder::transient_for_raw` or the Linux menu integration must enable one of them explicitly - those items are now gated behind the features.
    - Enabling both selects GTK 4, the same precedence `muda` and `tray-icon` use. Cargo does that whenever the dependency graph contains runtime crates that disagree on the GTK version, and such a binary can only ever run one of them, because GTK 3 and GTK 4 cannot be initialized in the same process. The GTK APIs and the Linux menu integration now fail with the new `Error::GtkVersionMismatch` under a runtime whose GTK version is not the one that was selected, instead of reinterpreting its window objects.
    - The `test` feature no longer implies GTK 3, so it can be combined with `gtk4`.
- [`c8c75b1f7`](https://www.github.com/tauri-apps/tauri/commit/c8c75b1f7f43e7cb1e7d773ed2f6f96fad2fe975) ([#15787](https://www.github.com/tauri-apps/tauri/pull/15787)) The Linux tray icon now uses the ksni (StatusNotifierItem over D-Bus) backend by default instead of libappindicator, dropping the libayatana-appindicator system dependency. The `tray-icon` feature no longer needs a GTK version to be selected. Enable the new `linux-libappindicator` feature to go back to the libappindicator backend.

<details>
<summary><em><h4>Cargo Publish</h4></em></summary>

```
Updating crates.io index
   Packaging tauri v3.0.0-alpha.0 (/home/runner/work/tauri/tauri/crates/tauri)
    Updating crates.io index
    Packaged 142 files, 1.4MiB (309.5KiB compressed)
   Verifying tauri v3.0.0-alpha.0 (/home/runner/work/tauri/tauri/crates/tauri)
 Downloading crates ...
  Downloaded alloc-no-stdlib v2.0.4
  Downloaded alloc-stdlib v0.2.4
  Downloaded cookie v0.18.2
  Downloaded serialize-to-javascript v0.1.2
  Downloaded brotli-decompressor v5.0.3
  Downloaded dpi v0.1.2
  Downloaded serde_repr v0.1.21
  Downloaded signal-hook-registry v1.4.8
  Downloaded muda v0.20.0
  Downloaded tokio-macros v2.7.2
  Downloaded raw-window-handle v0.6.2
  Downloaded serialize-to-javascript-impl v0.1.2
  Downloaded brotli v8.0.4
  Downloaded getrandom v0.3.4
  Downloaded tray-icon v0.25.0
  Downloaded futures-macro v0.3.34
  Downloaded tauri-runtime v3.0.0-alpha.0
  Downloaded keyboard-types v0.8.3
  Downloaded reqwest v0.13.4
  Downloaded tauri-macros v3.0.0-alpha.0
  Downloaded tauri-build v3.0.0-alpha.0
   Compiling serde_core v1.0.229
   Compiling zerofrom v0.1.8
   Compiling phf_shared v0.13.1
   Compiling serde v1.0.229
   Compiling yoke v0.8.3
   Compiling phf_generator v0.13.1
   Compiling stable_deref_trait v1.2.1
   Compiling zerovec v0.11.8
   Compiling phf_macros v0.13.1
   Compiling tinystr v0.8.4
   Compiling phf_codegen v0.13.1
   Compiling icu_locale_core v2.3.0
   Compiling potential_utf v0.1.6
   Compiling zerotrie v0.2.5
   Compiling icu_collections v2.3.0
   Compiling thiserror v2.0.20
   Compiling parking_lot_core v0.9.12
   Compiling phf v0.13.1
   Compiling string_cache_codegen v0.6.1
   Compiling serde_json v1.0.151
   Compiling icu_provider v2.3.1
   Compiling web_atoms v0.2.6
   Compiling icu_normalizer v2.3.0
   Compiling icu_properties v2.3.0
   Compiling parking_lot v0.12.5
   Compiling bytes v1.12.1
   Compiling alloc-no-stdlib v2.0.4
   Compiling smallvec v1.16.0
   Compiling alloc-stdlib v0.2.4
   Compiling string_cache v0.9.0
   Compiling idna_adapter v1.2.2
   Compiling getrandom v0.4.3
   Compiling serde_spanned v1.1.1
   Compiling toml_datetime v1.1.1+spec-1.1.0
   Compiling pin-project-lite v0.2.17
   Compiling futures-core v0.3.34
   Compiling form_urlencoded v1.2.2
   Compiling toml v1.1.5+spec-1.1.0
   Compiling uuid v1.26.0
   Compiling idna v1.1.0
   Compiling brotli-decompressor v5.0.3
   Compiling selectors v0.38.0
   Compiling cssparser v0.37.0
   Compiling markup5ever v0.39.0
   Compiling brotli v8.0.4
   Compiling url v2.5.8
   Compiling http v1.5.0
   Compiling percent-encoding v2.3.2
   Compiling html5ever v0.39.0
   Compiling jsonptr v0.7.1
   Compiling cfb v0.14.0
   Compiling erased-serde v0.4.10
   Compiling time v0.3.55
   Compiling mio v1.2.3
   Compiling socket2 v0.6.5
   Compiling tokio v1.53.1
   Compiling schemars v1.2.2
   Compiling dom_query v0.28.0
   Compiling plist v1.10.1
   Compiling infer v0.22.0
   Compiling cargo_metadata v0.19.2
   Compiling serde-untagged v0.1.9
   Compiling json-patch v4.2.0
   Compiling crc32fast v1.5.1
   Compiling urlpattern v0.6.0
   Compiling serde_with v3.23.0
   Compiling shlex v2.0.1
   Compiling find-msvc-tools v0.1.12
   Compiling cc v1.4.5
   Compiling flate2 v1.1.10
   Compiling tauri-utils v3.0.0-alpha.0
   Compiling http-body v1.1.0
   Compiling rustc_version v0.4.1
   Compiling time-macros v0.2.32
   Compiling once_cell v1.21.4
   Compiling httparse v1.10.1
   Compiling futures-task v0.3.34
   Compiling slab v0.4.12
   Compiling futures-util v0.3.34
   Compiling embed-resource v3.0.11
   Compiling bitflags v2.13.1
   Compiling try-lock v0.2.5
   Compiling crossbeam-utils v0.8.23
   Compiling tower-service v0.3.3
   Compiling png v0.17.16
   Compiling want v0.3.1
   Compiling tauri-winres v0.3.6
   Compiling tracing-core v0.1.36
   Compiling cargo_toml v1.0.1
   Compiling sync_wrapper v1.0.2
   Compiling futures-channel v0.3.34
   Compiling cookie v0.18.2
   Compiling atomic-waker v1.1.2
   Compiling tower-layer v0.3.3
   Compiling sha2 v0.10.9
   Compiling tower v0.5.3
   Compiling hyper v1.11.1
   Compiling ico v0.5.0
   Compiling tracing v0.1.44
   Compiling png v0.18.1
   Compiling dpi v0.1.2
   Compiling muda v0.20.0
   Compiling semver v1.0.28
   Compiling ipnet v2.12.2
   Compiling tauri-runtime v3.0.0-alpha.0
   Compiling tauri-build v3.0.0-alpha.0
   Compiling futures-sink v0.3.34
   Compiling getrandom v0.3.4
   Compiling tokio-util v0.7.19
   Compiling tauri-codegen v3.0.0-alpha.0
   Compiling hyper-util v0.1.20
   Compiling crossbeam-channel v0.5.17
   Compiling tower-http v0.6.11
   Compiling keyboard-types v0.8.3
   Compiling http-body-util v0.1.5
   Compiling serialize-to-javascript-impl v0.1.2
   Compiling raw-window-handle v0.6.2
   Compiling serialize-to-javascript v0.1.2
   Compiling reqwest v0.13.4
   Compiling serde_repr v0.1.21
   Compiling mime v0.3.17
   Compiling tauri v3.0.0-alpha.0 (/home/runner/work/tauri/tauri/target/package/tauri-3.0.0-alpha.0)
   Compiling tauri-macros v3.0.0-alpha.0
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 31.44s
   Uploading tauri v3.0.0-alpha.0 (/home/runner/work/tauri/tauri/crates/tauri)
    Uploaded tauri v3.0.0-alpha.0 to registry `crates-io`
note: waiting for tauri v3.0.0-alpha.0 to be available at registry `crates-io`
help: you may press ctrl-c to skip waiting; the crate should be available shortly
   Published tauri v3.0.0-alpha.0 at registry `crates-io`
```

</details>