[Feature] Waddlebot desktop client (Tauri) — M0/M1/M2 (stacked on #159)

[PenguinzTech]

Waddlebot desktop client (Tauri) — M0 scaffold + M1 auth + M2 frontend wiring

A Discord/TeamSpeak-style desktop app that is "a desktop representation of the webui." Tauri v2 (Rust shell) reusing the existing React SPA at admin/hub_module/frontend/; API calls are Rust-proxied so the user JWT lives in the OS keychain and never touches JS.

What's here

• M0 — desktop/ scaffold: Tauri v2, Rust shell, trait-based keychain (OsKeychain prod / InMemoryKeychain tests), configurable hub base URL, multi-stage Dockerfile.
• M1 — Tauri command layer (login/logout/store_token/get_token/clear_token/api_request), JWT in the OS keychain, Rust-injected Authorization: Bearer. api/keychain/proxy isolated as a pure-Rust lib — 7/7 lib tests pass in rust:1.97-slim; full Tauri GUI build runs in the webkit Docker image (CI). Cargo.lock committed.
• M2 — desktop-mode API adapter (desktopAdapter.js): detects window.__TAURI__ and routes API through invoke('api_request') + auth through the Tauri commands, while the browser path (axios + localStorage) is unchanged — one shared React app, no fork. AuthContext login/logout/protected-routes work in both modes. Frontend production build passes.

Stack — depends on #159

This is Part 2 of 2. It is stacked on #159 (the webui @penguin/react_libs → public @penguintechinc/react-libs@1.3.4 migration), so its base is fix/webui-frontend-lockfile and the diff shows only the desktop-specific changes. Merge #159 first, then this PR retargets to main.

Caveats / not yet done

• Full Tauri GUI build (webkit2gtk) is a CI step, not run locally.
• Deferred (M3+): OAuth via system browser + waddles:// deep-link, 401 → token refresh in the Rust proxy, super-admin roles, feature-parity screens, packaging/signing.

Not for merge yet — opened for review.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​axios@​1.7.7
	npm/​vitest@​3.0.0
	cargo/​tokio@​1.53.1
	npm/​react-router-dom@​7.0.1
	npm/​vite@​6.2.0
	npm/​@​typescript-eslint/​parser@​8.18.0
	npm/​@​types/​react-dom@​18.3.1
	npm/​@​types/​react@​18.3.21
	cargo/​reqwest@​0.12.28
	npm/​@​typescript-eslint/​eslint-plugin@​8.18.0
	cargo/​thiserror@​1.0.69
	cargo/​serde@​1.0.229
	npm/​@​types/​node@​22.10.5
	cargo/​tauri@​2.11.5
	cargo/​serde_json@​1.0.151
	npm/​socket.io-client@​4.8.1
	cargo/​tauri-plugin-updater@​2.10.1
	npm/​@​tauri-apps/​cli@​2.11.1
	npm/​@​tauri-apps/​api@​2.11.1
	cargo/​tauri-plugin-deep-link@​2.4.9
	cargo/​tauri-plugin-opener@​2.5.4
	npm/​typescript@​5.7.3
	cargo/​async-trait@​0.1.91
	cargo/​keyring@​3.6.3
	cargo/​tauri-build@​2.6.3
	cargo/​tracing@​0.1.44
	cargo/​tracing-subscriber@​0.3.23
	cargo/​uuid@​1.24.0
	cargo/​wiremock@​0.6.5
	npm/​@​vitejs/​plugin-react@​4.3.4

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Critical CVE: Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening CVE: GHSA-9crc-q9x8-hgqq Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening (CRITICAL) Affected versions: >= 1.0.0 < 1.6.1; >= 2.0.0 < 2.1.9; >= 3.0.0 < 3.0.5; <= 0.0.125 Patched version: 3.0.5 From: desktop/package-lock.json → npm/vitest@3.0.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vitest@3.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Obfuscated code: cargo hyper-util is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/reqwest@0.12.28 → cargo/tauri-plugin-updater@2.10.1 → cargo/tauri@2.11.5 → cargo/wiremock@0.6.5 → cargo/hyper-util@0.1.20 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/hyper-util@0.1.20. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Obfuscated code: cargo tokio is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: desktop/src-tauri/Cargo.lock → cargo/tokio@1.53.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/tokio@1.53.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Obfuscated code: cargo writeable is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/reqwest@0.12.28 → cargo/tauri-plugin-updater@2.10.1 → cargo/tauri-plugin-opener@2.5.4 → cargo/tauri-plugin-deep-link@2.4.9 → cargo/tauri-build@2.6.3 → cargo/tauri@2.11.5 → cargo/wiremock@0.6.5 → cargo/writeable@0.6.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/writeable@0.6.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Obfuscated code: npm axios is 82.0% likely obfuscated Confidence: 0.82 Location: Package overview From: desktop/package-lock.json → npm/axios@1.7.7 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/axios@1.7.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		High CVE: npm axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL CVE: GHSA-jr5f-v2jv-69x6 axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL (HIGH) Affected versions: >= 1.0.0 < 1.8.2; < 0.30.0 Patched version: 1.8.2 From: desktop/package-lock.json → npm/axios@1.7.7 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/axios@1.7.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		High CVE: Axios is vulnerable to DoS attack through lack of data size check CVE: GHSA-4hjh-wcwx-xvwj Axios is vulnerable to DoS attack through lack of data size check (HIGH) Affected versions: >= 1.0.0 < 1.12.0; >= 0.28.0 < 0.30.2 Patched version: 1.12.0 From: desktop/package-lock.json → npm/axios@1.7.7 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/axios@1.7.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		High CVE: React Router: Unauthenticated Denial of Service via Inefficient Route Matching in npm react-router CVE: GHSA-chx6-hx7r-mcp5 React Router: Unauthenticated Denial of Service via Inefficient Route Matching (HIGH) Affected versions: >= 7.0.0 < 7.18.0 Patched version: 7.18.0 From: desktop/package-lock.json → npm/react-router-dom@7.0.1 → npm/react-router@7.0.1 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-router@7.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		High CVE: React Router vulnerable to XSS via Open Redirects in npm react-router CVE: GHSA-2w69-qvjg-hvjx React Router vulnerable to XSS via Open Redirects (HIGH) Affected versions: >= 7.0.0 < 7.12.0 Patched version: 7.12.0 From: desktop/package-lock.json → npm/react-router-dom@7.0.1 → npm/react-router@7.0.1 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-router@7.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		High CVE: React Router SSR XSS in ScrollRestoration in npm react-router CVE: GHSA-8v8x-cx79-35w7 React Router SSR XSS in ScrollRestoration (HIGH) Affected versions: >= 7.0.0 < 7.12.0 Patched version: 7.12.0 From: desktop/package-lock.json → npm/react-router-dom@7.0.1 → npm/react-router@7.0.1 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-router@7.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		High CVE: React Router has XSS Vulnerability in npm react-router CVE: GHSA-3cgp-3xvw-98x8 React Router has XSS Vulnerability (HIGH) Affected versions: >= 7.0.0 < 7.9.0 Patched version: 7.9.0 From: desktop/package-lock.json → npm/react-router-dom@7.0.1 → npm/react-router@7.0.1 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-router@7.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		High CVE: React Router vulnerable to Denial of Service via reflected user input in single-fetch in npm react-router CVE: GHSA-rxv8-25v2-qmq8 React Router vulnerable to Denial of Service via reflected user input in single-fetch (HIGH) Affected versions: >= 7.0.0 < 7.14.0 Patched version: 7.14.0 From: desktop/package-lock.json → npm/react-router-dom@7.0.1 → npm/react-router@7.0.1 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-router@7.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		High CVE: React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE in npm react-router CVE: GHSA-49rj-9fvp-4h2h React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE (HIGH) Affected versions: >= 7.0.0 < 7.14.2 Patched version: 7.14.2 From: desktop/package-lock.json → npm/react-router-dom@7.0.1 → npm/react-router@7.0.1 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-router@7.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		High CVE: React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint in npm react-router CVE: GHSA-8x6r-g9mw-2r78 React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint (HIGH) Affected versions: >= 7.0.0 < 7.15.0 Patched version: 7.15.0 From: desktop/package-lock.json → npm/react-router-dom@7.0.1 → npm/react-router@7.0.1 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-router@7.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		High CVE: React Router allows pre-render data spoofing on React-Router framework mode CVE: GHSA-cpj6-fhp6-mr6j React Router allows pre-render data spoofing on React-Router framework mode (HIGH) Affected versions: >= 7.0.0-pre.0 < 7.5.2 Patched version: 7.5.2 From: desktop/package-lock.json → npm/react-router-dom@7.0.1 → npm/react-router@7.0.1 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-router@7.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		High CVE: React Router vulnerable to Denial of Service via reflected user input in single-fetch in npm turbo-stream CVE: GHSA-rxv8-25v2-qmq8 React Router vulnerable to Denial of Service via reflected user input in single-fetch (HIGH) Affected versions: < 3.0.0 Patched version: 3.0.0 From: desktop/package-lock.json → npm/react-router-dom@7.0.1 → npm/turbo-stream@2.4.0 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/turbo-stream@2.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		High CVE: Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket CVE: GHSA-p9ff-h696-f583 Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket (HIGH) Affected versions: >= 8.0.0 < 8.0.5; >= 7.0.0 < 7.3.2; >= 6.0.0 < 6.4.2 Patched version: 6.4.2 From: desktop/package-lock.json → npm/vite@6.2.0 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vite@6.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Filesystem access: cargo autocfg Location: Package overview From: ? → cargo/tauri-plugin-updater@2.10.1 → cargo/tauri-plugin-opener@2.5.4 → cargo/tauri-plugin-deep-link@2.4.9 → cargo/tauri-build@2.6.3 → cargo/tauri@2.11.5 → cargo/autocfg@1.5.1 ℹ Read more on: This package | This alert | What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/autocfg@1.5.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Filesystem access: cargo base64 Location: Package overview From: ? → cargo/tauri-plugin-updater@2.10.1 → cargo/tauri-plugin-opener@2.5.4 → cargo/tauri-plugin-deep-link@2.4.9 → cargo/tauri-build@2.6.3 → cargo/tauri@2.11.5 → cargo/base64@0.21.7 ℹ Read more on: This package | This alert | What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/base64@0.21.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Filesystem access: cargo base64 Location: Package overview From: ? → cargo/reqwest@0.12.28 → cargo/tauri-plugin-updater@2.10.1 → cargo/tauri-plugin-opener@2.5.4 → cargo/tauri-plugin-deep-link@2.4.9 → cargo/tauri-build@2.6.3 → cargo/tauri@2.11.5 → cargo/wiremock@0.6.5 → cargo/base64@0.22.1 ℹ Read more on: This package | This alert | What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/base64@0.22.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Filesystem access: cargo brotli-decompressor Location: Package overview From: ? → cargo/tauri-plugin-updater@2.10.1 → cargo/tauri-plugin-opener@2.5.4 → cargo/tauri-plugin-deep-link@2.4.9 → cargo/tauri-build@2.6.3 → cargo/tauri@2.11.5 → cargo/brotli-decompressor@5.0.3 ℹ Read more on: This package | This alert | What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/brotli-decompressor@5.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Filesystem access: cargo brotli Location: Package overview From: ? → cargo/tauri-plugin-updater@2.10.1 → cargo/tauri-plugin-opener@2.5.4 → cargo/tauri-plugin-deep-link@2.4.9 → cargo/tauri-build@2.6.3 → cargo/tauri@2.11.5 → cargo/brotli@8.0.4 ℹ Read more on: This package | This alert | What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/brotli@8.0.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Filesystem access: cargo bs58 Location: Package overview From: ? → cargo/tauri-plugin-updater@2.10.1 → cargo/tauri-plugin-opener@2.5.4 → cargo/tauri-plugin-deep-link@2.4.9 → cargo/tauri-build@2.6.3 → cargo/tauri@2.11.5 → cargo/bs58@0.5.1 ℹ Read more on: This package | This alert | What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/bs58@0.5.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Filesystem access: cargo combine Location: Package overview From: ? → cargo/tauri-plugin-updater@2.10.1 → cargo/tauri@2.11.5 → cargo/combine@4.6.7 ℹ Read more on: This package | This alert | What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/combine@4.6.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Filesystem access: cargo dbus Location: Package overview From: ? → cargo/tauri@2.11.5 → cargo/dbus@0.9.12 ℹ Read more on: This package | This alert | What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/dbus@0.9.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 49 more rows in the dashboard

View full report

[PenguinzTech]

Superseded — the desktop client has been migrated into the penguin repo as a penguind-integrated app (release/v0.2.X: penguin-desktop-core + desktop/ Tauri shell + penguin-module-waddlebot's BridgeActionProxy handling OBS/webhook actions). This standalone Tauri client is no longer needed and this PR is being closed unmerged in favor of that integration.