In the spirit of making Firezone as robust as possible, we make the FFI
calls infallible and complete as much of the task as possible. For
example, we don't fail `setDns` entirely just because we cannot parse a
single DNS server's IP.
Resolves: #10611
With the introduction of the DNS cache for Clients in #10533, we now
enable a behaviour where we don't necessarily need to establish a
connection to a Gateway to resolve a DNS query if we still have a valid
entry in the DNS cache. In particular, the proptests discovered that:
- a DNS query for an upstream resolver
- which happens to be a resource
- and has a valid entry in the DNS cache
- but (no longer) a connection to the corresponding Gateway
will now serve the cached DNS records instead of establishing a new
connection to the Gateway. As a result, the site status which we assert
in the proptests remains in "unknown" instead of the expected "online".
Modelling the caching behaviour in the tests is rather tedious. To avoid
that, we set the TTL of all simulated upstream DNS responses to 1 which
effectively bypasses the cache. Whilst not an ideal solution, it ensures
that CI is consistently green without flaky tests. The DNS cache itself
is already unit-tested.
Similar to how resources can be edited to change their address, IP stack
or other properties, they can also be moved between different sites.
Currently, `connlib` requires the portal to explicitly remove the
resource and then re-add it for this to work.
Our system gets more robust if we also detect that the sites of a
resource have changed and handle it like other addressability changes.
To ensure that this works correctly, we also extend the proptests to
simulate addressability changes of resources.
Resolves: #9881
Related: #10593
In order to support flow logs, we need to associate each IP packet that
gets routed with its corresponding resource ID. Currently, we only track
what is necessary for the actual routing behaviour: The IP addresses and
the filters. Therefore, we extend the data structures in `peer` to also
track the `ResourceId` now.
The entire code within `peer` became a bit hard to manage so I took this
opportunity to split it out into two dedicated modules.
This PR forms the base for recording flows logs in #10576.
In #10554, we added a syncing mechanism that would copy all link-scoped
routes of the `main` routing table over to the Firezone routing table.
Routes for interfaces that are currently offline cannot be added and
cause a netlink error of "Invalid argument".
To prevent unnecessary warnings from being logged to Sentry, we retrieve
the link state of each interface and skip routes for interfaces are not
online.
This PR eliminates JSON-based communication across the FFI boundary,
replacing it with proper
uniffi-generated types for improved type safety, performance, and
reliability. We replace JSON string parameters with native uniffi types
for:
- Resources (DNS, CIDR, Internet)
- Device information
- DNS server lists
- Network routes (CIDR representation)
Also, get rid of JSON serialisation in Swift client IPC in favour of
PropertyList based serialisation.
Fixes: https://github.com/firezone/firezone/issues/9548
---------
Co-authored-by: Thomas Eizinger <thomas@eizinger.io>
Several of these INFO logs are actually quite noisy, like exchanging
candidates with Gateways or updating the allocation. We barely look at
the INFO logs from customers and primarily investigate issues with DEBUG
logs streamed to Sentry.
In addition to the `iter` functions, `keys` and `values` also iterate
over the contents of a `HashMap` and are thus non-deterministic. This
can create problems where our test-suite is non-deterministic.
## Context
On Linux, we create a dedicated routing table for all routes of the
Firezone TUN device, including the `0.0.0.0/0` route. At a minimum, this
routing table contains the following if the Internet Resource is active:
```
> ip route show table 539098368
default dev tun-firezone proto static
100.64.0.0/11 dev tun-firezone proto static
100.96.0.0/11 dev tun-firezone proto static
100.100.111.0/24 dev tun-firezone proto static
```
In addition, we also create a routing rule that bypasses this routing
table for all packets that are tagged with the `0xfd002021` mark:
```
> ip rule list
0: from all lookup local
32765: not from all fwmark 0xfd002021 lookup 539098368
32766: from all lookup main
32767: from all lookup default
```
Firezone's internal UDP and TCP sockets are tagged with this mark and
thus prevent routing loops where our own packets would otherwise get
redirected back into the tunnel.
Without the Internet Resource active, the rule `from all lookup main`
triggers for local LAN traffic and correctly route the traffic out via
that interface.
For example, on my computer, the Linux kernel created the following
route with the `link` scope in the main table:
```
192.168.188.0/24 dev wlp192s0 proto kernel scope link src 192.168.188.112 metric 600
```
## The problem
With the Internet Resource active, there is a problem. The default route
matches ALL destinations, including those for local LAN destinations
which should actually be sent out via a different interface. As a
result, local LAN traffic is broken on Linux as soon as the Internet
Resource is active. Instead of being sent out via the local interface,
these packets get sent to `tun-firezone` where they get forwarded to the
Gateway and then dropped because their source IP is not a Firezone
Client IP.
## Solution
Fixing this is unfortunately non-trivial. The best I could come up with
is to create a copy of all link-scoped routes in the Firezone routing
table and keep those in sync with all route changes that happen. For
example, when we roam, the link-scoped routes obviously change because
we join a new subnet.
We therefore listen to change-events from netlink and create a debounced
task that reads the current link-scoped routes from the main routing
table, compares it to the ones in the Firezone table and adds any routes
not present.
We don't need to worry about removing routes as link-scoped routes
automatically disappear once the resulting interface goes away.
---------
Signed-off-by: Thomas Eizinger <thomas@eizinger.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.15.30 to 24.4.0.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react)
from 4.5.1 to 5.0.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite-plugin-react/releases"><code>@vitejs/plugin-react</code>'s
releases</a>.</em></p>
<blockquote>
<h2>plugin-react@5.0.2</h2>
<h3>Skip transform hook completely in rolldown-vite in dev if possible
(<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/783">#783</a>)</h3>
<h2>plugin-react@5.0.1</h2>
<h3>Set <code>optimizeDeps.rollupOptions.transform.jsx</code> instead of
<code>optimizeDeps.rollupOptions.jsx</code> for rolldown-vite (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/735">#735</a>)</h3>
<p><code>optimizeDeps.rollupOptions.jsx</code> is going to be deprecated
in favor of <code>optimizeDeps.rollupOptions.transform.jsx</code>.</p>
<h3>Perf: skip <code>babel-plugin-react-compiler</code> if code has no
<code>"use memo"</code> when <code>{ compilationMode:
"annotation" }</code> (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/734">#734</a>)</h3>
<h3>Respect tsconfig <code>jsxImportSource</code> (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/726">#726</a>)</h3>
<h3>Fix <code>reactRefreshHost</code> option on rolldown-vite (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/716">#716</a>)</h3>
<h3>Fix <code>RefreshRuntime</code> being injected twice for class
components on rolldown-vite (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/708">#708</a>)</h3>
<h3>Skip <code>babel-plugin-react-compiler</code> on non client
environment (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/689">689</a>)</h3>
<h2>plugin-react@5.0.0</h2>
<p>(Same content as v5.0.0-beta.0 <a
href="https://github.com/vitejs/vite-plugin-react/releases/tag/plugin-react%405.0.0-beta.0">https://github.com/vitejs/vite-plugin-react/releases/tag/plugin-react%405.0.0-beta.0</a>)</p>
<h3>Use Oxc for react refresh transform in rolldown-vite</h3>
<p>When used with rolldown-vite, this plugin now uses Oxc for react
refresh transform.</p>
<p>Since this behavior is what <code>@vitejs/plugin-react-oxc</code>
did, <code>@vitejs/plugin-react-oxc</code> is now deprecated and the
<code>disableOxcRecommendation</code> option is removed.</p>
<p>Also, while <code>@vitejs/plugin-react-oxc</code> used the production
JSX transform even for <code>NODE_ENV=development</code> build,
<code>@vitejs/plugin-react</code> uses the development JSX transform for
<code>NODE_ENV=development</code> build.</p>
<h3>Allow processing files in <code>node_modules</code></h3>
<p>The default value of <code>exclude</code> options is now
<code>[/\/node_modules\//]</code> to allow processing files in
<code>node_modules</code> directory. It was previously <code>[]</code>
and files in <code>node_modules</code> was always excluded regardless of
the value of <code>exclude</code> option.</p>
<h3><code>react</code> and <code>react-dom</code> is no longer added to
<a
href="https://vite.dev/config/#resolve-dedupe"><code>resolve.dedupe</code></a>
automatically</h3>
<p>Adding values to <code>resolve.dedupe</code> forces Vite to resolve
them differently from how Node.js does, which can be confusing and may
not be expected. This plugin no longer adds <code>react</code> and
<code>react-dom</code> to <code>resolve.dedupe</code> automatically.</p>
<p>If you encounter errors after upgrading, check your package.json for
version mismatches in <code>dependencies</code> or
<code>devDependencies</code>, as well as your package manager’s
configuration. If you prefer the previous behavior, you can manually add
<code>react</code> and <code>react-dom</code> to
<code>resolve.dedupe</code>.</p>
<h3>Remove old <code>babel-plugin-react-compiler</code> support that
requires <code>runtimeModule</code> option</h3>
<p><code>runtimeModule</code> option is no longer needed in newer
<code>babel-plugin-react-compiler</code> versions. Make sure to use a
newer version of <code>babel-plugin-react-compiler</code> that supports
<code>target</code> option.</p>
<h3>Require Node 20.19+, 22.12+</h3>
<p>This plugin now requires Node 20.19+ or 22.12+.</p>
<h2>plugin-react@5.0.0-beta.0</h2>
<h3>Use Oxc for react refresh transform in rolldown-vite</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md"><code>@vitejs/plugin-react</code>'s
changelog</a>.</em></p>
<blockquote>
<h2>5.0.2 (2025-08-28)</h2>
<h3>Skip transform hook completely in rolldown-vite in dev if possible
(<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/783">#783</a>)</h3>
<h2>5.0.1 (2025-08-19)</h2>
<h3>Set <code>optimizeDeps.rollupOptions.transform.jsx</code> instead of
<code>optimizeDeps.rollupOptions.jsx</code> for rolldown-vite (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/735">#735</a>)</h3>
<p><code>optimizeDeps.rollupOptions.jsx</code> is going to be deprecated
in favor of <code>optimizeDeps.rollupOptions.transform.jsx</code>.</p>
<h3>Perf: skip <code>babel-plugin-react-compiler</code> if code has no
<code>"use memo"</code> when <code>{ compilationMode:
"annotation" }</code> (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/734">#734</a>)</h3>
<h3>Respect tsconfig <code>jsxImportSource</code> (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/726">#726</a>)</h3>
<h3>Fix <code>reactRefreshHost</code> option on rolldown-vite (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/716">#716</a>)</h3>
<h3>Fix <code>RefreshRuntime</code> being injected twice for class
components on rolldown-vite (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/708">#708</a>)</h3>
<h3>Skip <code>babel-plugin-react-compiler</code> on non client
environment (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/689">689</a>)</h3>
<h2>5.0.0 (2025-08-07)</h2>
<h2>5.0.0-beta.0 (2025-07-28)</h2>
<h3>Use Oxc for react refresh transform in rolldown-vite</h3>
<p>When used with rolldown-vite, this plugin now uses Oxc for react
refresh transform.</p>
<p>Since this behavior is what <code>@vitejs/plugin-react-oxc</code>
did, <code>@vitejs/plugin-react-oxc</code> is now deprecated and the
<code>disableOxcRecommendation</code> option is removed.</p>
<p>Also, while <code>@vitejs/plugin-react-oxc</code> used the production
JSX transform even for <code>NODE_ENV=development</code> build,
<code>@vitejs/plugin-react</code> uses the development JSX transform for
<code>NODE_ENV=development</code> build.</p>
<h3>Allow processing files in <code>node_modules</code></h3>
<p>The default value of <code>exclude</code> options is now
<code>[/\/node_modules\//]</code> to allow processing files in
<code>node_modules</code> directory. It was previously <code>[]</code>
and files in <code>node_modules</code> was always excluded regardless of
the value of <code>exclude</code> option.</p>
<h3><code>react</code> and <code>react-dom</code> is no longer added to
<a
href="https://vite.dev/config/#resolve-dedupe"><code>resolve.dedupe</code></a>
automatically</h3>
<p>Adding values to <code>resolve.dedupe</code> forces Vite to resolve
them differently from how Node.js does, which can be confusing and may
not be expected. This plugin no longer adds <code>react</code> and
<code>react-dom</code> to <code>resolve.dedupe</code> automatically.</p>
<p>If you encounter errors after upgrading, check your package.json for
version mismatches in <code>dependencies</code> or
<code>devDependencies</code>, as well as your package manager’s
configuration. If you prefer the previous behavior, you can manually add
<code>react</code> and <code>react-dom</code> to
<code>resolve.dedupe</code>.</p>
<h3>Remove old <code>babel-plugin-react-compiler</code> support that
requires <code>runtimeModule</code> option</h3>
<p><code>runtimeModule</code> option is no longer needed in newer
<code>babel-plugin-react-compiler</code> versions. Make sure to use a
newer version of <code>babel-plugin-react-compiler</code> that supports
<code>target</code> option.</p>
<h3>Require Node 20.19+, 22.12+</h3>
<p>This plugin now requires Node 20.19+ or 22.12+.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1f4b4d9523"><code>1f4b4d9</code></a>
release: plugin-react@5.0.2</li>
<li><a
href="c719e5d97d"><code>c719e5d</code></a>
perf(react): skip transform hook completely in rolldown-vite in dev if
possib...</li>
<li><a
href="9989897fd1"><code>9989897</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/773">#773</a>)</li>
<li><a
href="1ab26664ad"><code>1ab2666</code></a>
build: watch <code>common</code> package (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/748">#748</a>)</li>
<li><a
href="efe4344175"><code>efe4344</code></a>
release: plugin-react@5.0.1</li>
<li><a
href="126bdb0051"><code>126bdb0</code></a>
feat: set <code>optimizeDeps.rollupOptions.transform.jsx</code> instead
of `optimizeDeps...</li>
<li><a
href="d3934ada6f"><code>d3934ad</code></a>
perf(react): skip react compiler when <code>compilationMode:
"annotation"</code> but no ...</li>
<li><a
href="e2f0c78a4f"><code>e2f0c78</code></a>
fix(react): respect tsconfig jsxImportSource by default (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/726">#726</a>)</li>
<li><a
href="ba0323cfcd"><code>ba0323c</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/729">#729</a>)</li>
<li><a
href="d33f37db05"><code>d33f37d</code></a>
refactor(react): simplify rolldown-vite only plugins (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/720">#720</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/vite-plugin-react/commits/plugin-react@5.0.2/packages/plugin-react">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
For more permanent Gateway installations, or ones that are managed
through something else other than our install script, it is useful to
define the Gateway's token outside the systemd unit file.
Systemd provides support for credentials via the `LoadCredential` and
`LoadCredentialEncrypted` instructions. We just need a tiny bit of glue
code in the Gateway to actually use that if it is set.
---------
Signed-off-by: Thomas Eizinger <thomas@eizinger.io>
Co-authored-by: Jamil <jamilbk@users.noreply.github.com>
Currently, the Internet Resource cannot be toggled on/off in the
headless client. With #10509, the default state of the Internet Resource
is now disabled, meaning users of the headless client are no longer able
to use the Internet Resource.
We fix this by introducing a new CLI argument
`--activate-internet-resource` that can also be set via the env variable
`FIREZONE_ACTIVATE_INTERNET_RESOURCE=true`.
Resolves: #8342
When using the Internet Resource, it can happen that Clients are still
receiving packets with a source IP that is different from the TUN IP.
Such packets are dropped on the Gateway already today and therefore have
never been routed to their destination.
The Gateway cannot route these packets because the reply packets would
have the original source address set as the destination and that one is
not unique across all Firezone Clients. Without a unique destination,
the Gateway cannot send the packet to the correct Client.
Today, these packets are filtered on the Gateway and thus trigger an
ICMP error. With the addition of #10462, we create a new flow for each
one of these packets. To prevent this spam, we drop such packets early
in the Client and don't even route them to the Gateway.
Bumps the aya group in /rust with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [aya](https://github.com/aya-rs/aya) | ``ec3eacc`` | ``fe99fa1`` |
| [aya-build](https://github.com/aya-rs/aya) | ``ec3eacc`` | ``fe99fa1``
|
| [aya-ebpf](https://github.com/aya-rs/aya) | ``ec3eacc`` | ``fe99fa1``
|
| [aya-log](https://github.com/aya-rs/aya) | ``ec3eacc`` | ``fe99fa1`` |
| [aya-log-ebpf](https://github.com/aya-rs/aya) | ``ec3eacc`` |
``fe99fa1`` |
Updates `aya` from `ec3eacc` to `fe99fa1`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fe99fa1d2e"><code>fe99fa1</code></a>
ebpf: run clippy with target=bpf</li>
<li><a
href="552b69367f"><code>552b693</code></a>
xtask: remove outdated snippet</li>
<li><a
href="bb45904b08"><code>bb45904</code></a>
xtask: patch gen_init_cpio.c</li>
<li><a
href="8e31f5fa43"><code>8e31f5f</code></a>
Merge pull request <a
href="https://redirect.github.com/aya-rs/aya/issues/1355">#1355</a> from
aya-rs/dependabot/cargo/cargo-crates-7838c61200</li>
<li><a
href="ace02870f2"><code>ace0287</code></a>
build(deps): update cargo_metadata requirement in the cargo-crates
group</li>
<li><a
href="5f5305c2a8"><code>5f5305c</code></a>
lint all crates; enable strict pointer lints</li>
<li>See full diff in <a
href="ec3eacc1d8...fe99fa1d2e">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-build` from `ec3eacc` to `fe99fa1`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fe99fa1d2e"><code>fe99fa1</code></a>
ebpf: run clippy with target=bpf</li>
<li><a
href="552b69367f"><code>552b693</code></a>
xtask: remove outdated snippet</li>
<li><a
href="bb45904b08"><code>bb45904</code></a>
xtask: patch gen_init_cpio.c</li>
<li><a
href="8e31f5fa43"><code>8e31f5f</code></a>
Merge pull request <a
href="https://redirect.github.com/aya-rs/aya/issues/1355">#1355</a> from
aya-rs/dependabot/cargo/cargo-crates-7838c61200</li>
<li><a
href="ace02870f2"><code>ace0287</code></a>
build(deps): update cargo_metadata requirement in the cargo-crates
group</li>
<li><a
href="5f5305c2a8"><code>5f5305c</code></a>
lint all crates; enable strict pointer lints</li>
<li>See full diff in <a
href="ec3eacc1d8...fe99fa1d2e">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-ebpf` from `ec3eacc` to `fe99fa1`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fe99fa1d2e"><code>fe99fa1</code></a>
ebpf: run clippy with target=bpf</li>
<li><a
href="552b69367f"><code>552b693</code></a>
xtask: remove outdated snippet</li>
<li><a
href="bb45904b08"><code>bb45904</code></a>
xtask: patch gen_init_cpio.c</li>
<li><a
href="8e31f5fa43"><code>8e31f5f</code></a>
Merge pull request <a
href="https://redirect.github.com/aya-rs/aya/issues/1355">#1355</a> from
aya-rs/dependabot/cargo/cargo-crates-7838c61200</li>
<li><a
href="ace02870f2"><code>ace0287</code></a>
build(deps): update cargo_metadata requirement in the cargo-crates
group</li>
<li><a
href="5f5305c2a8"><code>5f5305c</code></a>
lint all crates; enable strict pointer lints</li>
<li>See full diff in <a
href="ec3eacc1d8...fe99fa1d2e">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-log` from `ec3eacc` to `fe99fa1`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fe99fa1d2e"><code>fe99fa1</code></a>
ebpf: run clippy with target=bpf</li>
<li><a
href="552b69367f"><code>552b693</code></a>
xtask: remove outdated snippet</li>
<li><a
href="bb45904b08"><code>bb45904</code></a>
xtask: patch gen_init_cpio.c</li>
<li><a
href="8e31f5fa43"><code>8e31f5f</code></a>
Merge pull request <a
href="https://redirect.github.com/aya-rs/aya/issues/1355">#1355</a> from
aya-rs/dependabot/cargo/cargo-crates-7838c61200</li>
<li><a
href="ace02870f2"><code>ace0287</code></a>
build(deps): update cargo_metadata requirement in the cargo-crates
group</li>
<li><a
href="5f5305c2a8"><code>5f5305c</code></a>
lint all crates; enable strict pointer lints</li>
<li>See full diff in <a
href="ec3eacc1d8...fe99fa1d2e">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-log-ebpf` from `ec3eacc` to `fe99fa1`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fe99fa1d2e"><code>fe99fa1</code></a>
ebpf: run clippy with target=bpf</li>
<li><a
href="552b69367f"><code>552b693</code></a>
xtask: remove outdated snippet</li>
<li><a
href="bb45904b08"><code>bb45904</code></a>
xtask: patch gen_init_cpio.c</li>
<li><a
href="8e31f5fa43"><code>8e31f5f</code></a>
Merge pull request <a
href="https://redirect.github.com/aya-rs/aya/issues/1355">#1355</a> from
aya-rs/dependabot/cargo/cargo-crates-7838c61200</li>
<li><a
href="ace02870f2"><code>ace0287</code></a>
build(deps): update cargo_metadata requirement in the cargo-crates
group</li>
<li><a
href="5f5305c2a8"><code>5f5305c</code></a>
lint all crates; enable strict pointer lints</li>
<li>See full diff in <a
href="ec3eacc1d8...fe99fa1d2e">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the npm_and_yarn group with 1 update in the /rust/gui-client
directory:
[vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).
Updates `vite` from 6.3.5 to 6.3.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases">vite's
releases</a>.</em></p>
<blockquote>
<h2>v6.3.6</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v6.3.6/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/v6.3.6/packages/vite/CHANGELOG.md">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted -->6.3.6 (2025-09-08)<!-- raw HTML omitted
--></h2>
<ul>
<li>fix: apply <code>fs.strict</code> check to HTML files (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20736">#20736</a>)
(<a
href="0ab19ea9fc">0ab19ea</a>),
closes <a
href="https://redirect.github.com/vitejs/vite/issues/20736">#20736</a></li>
<li>fix: upgrade sirv to 3.0.2 (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20735">#20735</a>)
(<a
href="e11d24008b">e11d240</a>),
closes <a
href="https://redirect.github.com/vitejs/vite/issues/20735">#20735</a></li>
<li>test: detect ts support via <code>process.features</code> (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20544">#20544</a>)
(<a
href="7d9922972b">7d99229</a>),
closes <a
href="https://redirect.github.com/vitejs/vite/issues/20544">#20544</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="3f337c5e24"><code>3f337c5</code></a>
release: v6.3.6</li>
<li><a
href="e11d24008b"><code>e11d240</code></a>
fix: upgrade sirv to 3.0.2 (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20735">#20735</a>)</li>
<li><a
href="0ab19ea9fc"><code>0ab19ea</code></a>
fix: apply <code>fs.strict</code> check to HTML files (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20736">#20736</a>)</li>
<li><a
href="7d9922972b"><code>7d99229</code></a>
test: detect ts support via <code>process.features</code> (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20544">#20544</a>)</li>
<li>See full diff in <a
href="https://github.com/vitejs/vite/commits/v6.3.6/packages/vite">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/firezone/firezone/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@fontsource-variable/source-sans-3](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/source-sans-3)
from 5.2.8 to 5.2.9.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/source-sans-3">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
The `mio` library which underpins `tokio` has a bug on Windows in
regards to named pipes where under certain circumstances an "unreachable
code" section is entered. See
https://github.com/tokio-rs/mio/issues/1819 for the upstream bug report.
In this PR, we patch in a fork of `mio` that aims to fix these issues by
handling the state transitions more gracefully. I am not a Windows
expert by any means so this will need some rigorous testing to make sure
the IPC channel between GUI and Tunnel service still works reliably.
Related: https://github.com/tokio-rs/mio/pull/1903
On Fedora, when a package gets upgraded, the new package is installed
first, followed by the uninstall of the old package. As a result, the
`prerm` script is called after the `postinst` script of the new package.
In our `prerm` script, we stop the tunnel service. On package upgrades,
this results in us stopping the tunnel service after installing the new
package, confronting the user with an error that the tunnel service is
not running.
`rpm` passes arguments to these maintenance scripts. In the case of
`prerm`, we receive the count of how many other instances of this
packages are installed. To fix this bug, we check whether the first
argument to the script is "1", meaning that we are being upgraded and
should not stop the tunnel service.
Whilst the regression seeds file itself is useful to have a fixed set of
tests that are always run, the comments what a specific seed samples to
quickly get outdated as the test suite evolves. Therefore, we remove the
comments to not confuse developers.
Firezone Clients set themselves as the system-wide DNS resolver on
startup. This is necessary to intercept queries for DNS resources which
resolve to proxy IPs whilst Firezone is active.
All DNS queries for non-resources are forwarded to either the resolver
defined on the system or the ones defined in the portal (if any). These
DNS servers can also be CIDR resources in which cases the queries get
forwarded through the tunnel to a Gateway.
Right now, the responses from these DNS servers are never cached. DNS is
pretty heavily relied on on most systems and having DNS fail or be slow
usually results in a bad user experience.
To improve on this, we embed a small DNS cache into connlib where for
each query, we first try to answer it from the cache. Queries otherwise
forwarded to the system/upstream resolver or through the tunnel will see
a much improved response time with this change.
When serving responses from this cache, the TTL is decremented
automatically based on how much time has passed since the entry was
first added to the cache. Outside of the response time being ~1ms, this
makes the cache fully transparent.
Resolves: #10508
Building on top of #10507, setting the initial Internet Resource state
is a piece of cake. All we need to do is thread a boolean variable
through to all call-sites of `Session::connect`. Without the need for
the Internet Resource's ID, we can simply pass in the boolean that is
saved in the configuration of each client.
Resolves: #10255
Instead of the generic "disable any kind of resource"-functionality that
connlib currently exposes, we now provide an API to only enable /
disable the Internet Resource. This is a lot simpler to deal with and
reason about than the previous system, especially when it comes to the
proptests. Those need to model connlib's behaviour correctly across its
entire API surface which makes them unnecessarily complex if we only
ever use the `set_disabled_resources` API with a single resource.
In preparation for #4789, I want to extend the proptests to cover
traffic filters (#7126). This will make them a fair bit more
complicated, so any prior removal of complexity is appreciated.
Simplifying the implementation here is also a good starting point to fix
#10255. Not implicitly enabling the Internet Resource when it gets added
should be quite simple after this change.
Finally, resolving #8885 should also be quite easy. We just need to
store the state of the Internet Resource once per API URL instead of
globally.
Resolves: #8404
---------
Signed-off-by: Thomas Eizinger <thomas@eizinger.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
In #10347, we made sure that we always return all errors that happen
during a single tick of the event-loop. What we overlooked is that as
part of handling the errors, we need to use `continue` to jump to the
next one instead of returning directly from the function.
Signed-off-by: Thomas Eizinger <thomas@eizinger.io>
When a Client disconnects from a Gateway, we might still be receiving
packets that are either in-flight or are still being sent by the
resource. For some amount of time after a disconnect, this is expected
and not worth logging a warning for.
With this PR, we define this time to be 60s. If we cannot look up a
connection either by ID, session index or public key but the peer has
disconnected within the last 60s, we will now only print a DEBUG log
instead of a WARN.
Resolves: #10175
Instead of mirroring the ECN bits of an IP packet on the resulting UDP
packet in the event-loop, we can extend `Transmit` with an `ecn` field
and directly set it every time we construct a `Transmit`, mirroring the
ECN bits from the inner IP packet if the UDP packet contains an
encapsulated IP packet.
Extracted from #10485
When an application sends UDP packets that are larger than the MTU of
the underlying interface, the kernel fragments the packet at the IP
level. Firezone does not support fragmented IP packets because we need
to pack each IP packet into a UDP packet.
Right now, we don't check for fragmented IP packets which results in
packet parsing errors because the slice we are trying to parse the
packet from is not long enough.
To avoid spamming Sentry in these cases, we explicitly check for
fragmented IP packets and only log those on DEBUG.
Resolves: #10335
Bumps [zbus](https://github.com/dbus2/zbus) from 5.9.0 to 5.11.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/dbus2/zbus/releases">zbus's
releases</a>.</em></p>
<blockquote>
<h2>🔖 zbus 5.11.0</h2>
<ul>
<li>✨ API to specify timeouts for method calls. Add a way to specify an
timeout for method calls. If
set, the method calls will timeout after the specified duration,
returning an error. This can be
used to handle the issues with non-answering D-Bus services.</li>
<li>🩹 Add <code>connection::socket::Split::new</code> method, allowing
<code>Socket</code> trait impls outside zbus.</li>
<li>📝 Mention receive_X_changes in <code>proxy</code> docs.</li>
</ul>
<h2>🔖 zbus 5.10.0</h2>
<ul>
<li>✨ Property stream will now first yield the current value.</li>
<li>🐛 Fall back to no groups rather than erroring out for peer
creds.</li>
<li>📝 Fix wrong documentation in blocking <code>Proxy</code>
methods.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="edd9a3c3d3"><code>edd9a3c</code></a>
Merge pull request <a
href="https://redirect.github.com/dbus2/zbus/issues/1494">#1494</a> from
zeenix/prep-zb-5.11</li>
<li><a
href="ee3fb1b4f7"><code>ee3fb1b</code></a>
🔖 zb,zm: Release 5.11.0</li>
<li><a
href="9f85ee4b3d"><code>9f85ee4</code></a>
✅ zb: Much shorter timeout in method timeout test</li>
<li><a
href="000039a7d8"><code>000039a</code></a>
♻️ zb: Micro simplification</li>
<li><a
href="dbd853e3be"><code>dbd853e</code></a>
⬆️ micro: Update chrono to v0.4.42 (<a
href="https://redirect.github.com/dbus2/zbus/issues/1493">#1493</a>)</li>
<li><a
href="bd4d5c722e"><code>bd4d5c7</code></a>
Merge pull request <a
href="https://redirect.github.com/dbus2/zbus/issues/1491">#1491</a> from
dbus2/security-policy</li>
<li><a
href="29825e74cc"><code>29825e7</code></a>
🔒️ Add comprehensive security policy</li>
<li><a
href="e46151c9ad"><code>e46151c</code></a>
Merge pull request <a
href="https://redirect.github.com/dbus2/zbus/issues/1477">#1477</a> from
sergeyfd/main</li>
<li><a
href="979f5f9030"><code>979f5f9</code></a>
✨ zb: API to specify timeouts for method calls</li>
<li><a
href="442063d295"><code>442063d</code></a>
⬆️ micro: Update time to v0.3.43 (<a
href="https://redirect.github.com/dbus2/zbus/issues/1490">#1490</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/dbus2/zbus/compare/zbus-5.9.0...zbus-5.11.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Instead of logging this inside the event-loop, it is better to move it
into the corresponding handler function to free up the event-loop from
as much "logic" as possible. It should ideally only be concerned with
linking the state machine with the IO components that actually cause the
side-effects.
Bumps [keyring](https://github.com/hwchen/keyring-rs) from 3.6.2 to
3.6.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/hwchen/keyring-rs/releases">keyring's
releases</a>.</em></p>
<blockquote>
<h2>v3.6.3: Likely final release of v3</h2>
<p>This release integrates a few important bug fixes (thanks <a
href="https://github.com/vermiculus"><code>@vermiculus</code></a>, <a
href="https://github.com/unkcpz"><code>@unkcpz</code></a>) that have
come in since the release of v3.6.2, and is the last release expected
for the v3 series. The release of v4 is expected in about a month, and
it will bring significant changes:</p>
<ul>
<li>the cross-platform API will become its own crate: keyring-core.</li>
<li>each credential store will become its own store.</li>
<li>this crate will become an example of how to write a keyring-based
application.</li>
</ul>
<p>PLEASE NOTE: with this release, the main branch has changed
significantly. What was on the main branch has moved to be a v4 branch,
and the main branch was reverted to v3.6.2 and then had bug fix commits
added on. If you have an existing fork of this repository, you should
immediately sync your repo by choosing the "discard commits"
option, which will take your repo back to v3.6.2 and then pull the newer
commits. Then, if you have development work on one of your other
branches, you should rebase that work onto the updated main.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="315cbdf6c6"><code>315cbdf</code></a>
Credits for v3.6.3 release.</li>
<li><a
href="edee747db0"><code>edee747</code></a>
Merge pull request <a
href="https://redirect.github.com/hwchen/keyring-rs/issues/260">#260</a>
from open-source-cooperative/dependabot/cargo/windows...</li>
<li><a
href="a3470f1260"><code>a3470f1</code></a>
Update windows-sys requirement from 0.59 to 0.60</li>
<li><a
href="f38b5e9afa"><code>f38b5e9</code></a>
Cherry pick all contributions since 3.6.2.</li>
<li><a
href="b9af61dc5a"><code>b9af61d</code></a>
Zero out credential passwords before dealloc.</li>
<li><a
href="19ec928f2b"><code>19ec928</code></a>
Don't clone returned passwords.</li>
<li><a
href="46eebf5688"><code>46eebf5</code></a>
windows: use static value for 'comment' attribute</li>
<li><a
href="7b408eddc7"><code>7b408ed</code></a>
Revert variable renaming</li>
<li><a
href="88a3d6c01d"><code>88a3d6c</code></a>
Cosmetic fix: remove blank lines</li>
<li><a
href="afcc3148ca"><code>afcc314</code></a>
Implement default byte -> password conversion methods.</li>
<li>Additional commits viewable in <a
href="https://github.com/hwchen/keyring-rs/compare/v3.6.2...v3.6.3">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the aya group in /rust with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [aya](https://github.com/aya-rs/aya) | ``3018246`` | ``ec3eacc`` |
| [aya-build](https://github.com/aya-rs/aya) | ``3018246`` | ``ec3eacc``
|
| [aya-ebpf](https://github.com/aya-rs/aya) | ``3018246`` | ``ec3eacc``
|
| [aya-log](https://github.com/aya-rs/aya) | ``3018246`` | ``ec3eacc`` |
| [aya-log-ebpf](https://github.com/aya-rs/aya) | ``3018246`` |
``ec3eacc`` |
Updates `aya` from `3018246` to `ec3eacc`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ec3eacc1d8"><code>ec3eacc</code></a>
Increase VM memory</li>
<li><a
href="d1bb7bcc38"><code>d1bb7bc</code></a>
deny clippy::unnecessary_cast</li>
<li><a
href="be4d74fd06"><code>be4d74f</code></a>
deny clippy::fn_to_numeric_cast{,_with_truncation}</li>
<li><a
href="fa03dbdb46"><code>fa03dbd</code></a>
deny clippy::char_lit_as_u8</li>
<li><a
href="a7206b9098"><code>a7206b9</code></a>
deny clippy::cast_precision_loss</li>
<li><a
href="72104c4076"><code>72104c4</code></a>
deny clippy::cast_lossless</li>
<li><a
href="82e72a14ad"><code>82e72a1</code></a>
Remove unused import</li>
<li><a
href="d1fdbb9930"><code>d1fdbb9</code></a>
Update to macOS 15 (<a
href="https://redirect.github.com/aya-rs/aya/issues/1351">#1351</a>)</li>
<li><a
href="e2a68ee384"><code>e2a68ee</code></a>
aya-log: add <code>#[must_use]</code> attribute to
<code>EbpfLogger</code></li>
<li>See full diff in <a
href="30182463bd...ec3eacc1d8">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-build` from `3018246` to `ec3eacc`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ec3eacc1d8"><code>ec3eacc</code></a>
Increase VM memory</li>
<li><a
href="d1bb7bcc38"><code>d1bb7bc</code></a>
deny clippy::unnecessary_cast</li>
<li><a
href="be4d74fd06"><code>be4d74f</code></a>
deny clippy::fn_to_numeric_cast{,_with_truncation}</li>
<li><a
href="fa03dbdb46"><code>fa03dbd</code></a>
deny clippy::char_lit_as_u8</li>
<li><a
href="a7206b9098"><code>a7206b9</code></a>
deny clippy::cast_precision_loss</li>
<li><a
href="72104c4076"><code>72104c4</code></a>
deny clippy::cast_lossless</li>
<li><a
href="82e72a14ad"><code>82e72a1</code></a>
Remove unused import</li>
<li><a
href="d1fdbb9930"><code>d1fdbb9</code></a>
Update to macOS 15 (<a
href="https://redirect.github.com/aya-rs/aya/issues/1351">#1351</a>)</li>
<li><a
href="e2a68ee384"><code>e2a68ee</code></a>
aya-log: add <code>#[must_use]</code> attribute to
<code>EbpfLogger</code></li>
<li>See full diff in <a
href="30182463bd...ec3eacc1d8">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-ebpf` from `3018246` to `ec3eacc`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ec3eacc1d8"><code>ec3eacc</code></a>
Increase VM memory</li>
<li><a
href="d1bb7bcc38"><code>d1bb7bc</code></a>
deny clippy::unnecessary_cast</li>
<li><a
href="be4d74fd06"><code>be4d74f</code></a>
deny clippy::fn_to_numeric_cast{,_with_truncation}</li>
<li><a
href="fa03dbdb46"><code>fa03dbd</code></a>
deny clippy::char_lit_as_u8</li>
<li><a
href="a7206b9098"><code>a7206b9</code></a>
deny clippy::cast_precision_loss</li>
<li><a
href="72104c4076"><code>72104c4</code></a>
deny clippy::cast_lossless</li>
<li><a
href="82e72a14ad"><code>82e72a1</code></a>
Remove unused import</li>
<li><a
href="d1fdbb9930"><code>d1fdbb9</code></a>
Update to macOS 15 (<a
href="https://redirect.github.com/aya-rs/aya/issues/1351">#1351</a>)</li>
<li><a
href="e2a68ee384"><code>e2a68ee</code></a>
aya-log: add <code>#[must_use]</code> attribute to
<code>EbpfLogger</code></li>
<li>See full diff in <a
href="30182463bd...ec3eacc1d8">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-log` from `3018246` to `ec3eacc`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ec3eacc1d8"><code>ec3eacc</code></a>
Increase VM memory</li>
<li><a
href="d1bb7bcc38"><code>d1bb7bc</code></a>
deny clippy::unnecessary_cast</li>
<li><a
href="be4d74fd06"><code>be4d74f</code></a>
deny clippy::fn_to_numeric_cast{,_with_truncation}</li>
<li><a
href="fa03dbdb46"><code>fa03dbd</code></a>
deny clippy::char_lit_as_u8</li>
<li><a
href="a7206b9098"><code>a7206b9</code></a>
deny clippy::cast_precision_loss</li>
<li><a
href="72104c4076"><code>72104c4</code></a>
deny clippy::cast_lossless</li>
<li><a
href="82e72a14ad"><code>82e72a1</code></a>
Remove unused import</li>
<li><a
href="d1fdbb9930"><code>d1fdbb9</code></a>
Update to macOS 15 (<a
href="https://redirect.github.com/aya-rs/aya/issues/1351">#1351</a>)</li>
<li><a
href="e2a68ee384"><code>e2a68ee</code></a>
aya-log: add <code>#[must_use]</code> attribute to
<code>EbpfLogger</code></li>
<li>See full diff in <a
href="30182463bd...ec3eacc1d8">compare
view</a></li>
</ul>
</details>
<br />
Updates `aya-log-ebpf` from `3018246` to `ec3eacc`
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ec3eacc1d8"><code>ec3eacc</code></a>
Increase VM memory</li>
<li><a
href="d1bb7bcc38"><code>d1bb7bc</code></a>
deny clippy::unnecessary_cast</li>
<li><a
href="be4d74fd06"><code>be4d74f</code></a>
deny clippy::fn_to_numeric_cast{,_with_truncation}</li>
<li><a
href="fa03dbdb46"><code>fa03dbd</code></a>
deny clippy::char_lit_as_u8</li>
<li><a
href="a7206b9098"><code>a7206b9</code></a>
deny clippy::cast_precision_loss</li>
<li><a
href="72104c4076"><code>72104c4</code></a>
deny clippy::cast_lossless</li>
<li><a
href="82e72a14ad"><code>82e72a1</code></a>
Remove unused import</li>
<li><a
href="d1fdbb9930"><code>d1fdbb9</code></a>
Update to macOS 15 (<a
href="https://redirect.github.com/aya-rs/aya/issues/1351">#1351</a>)</li>
<li><a
href="e2a68ee384"><code>e2a68ee</code></a>
aya-log: add <code>#[must_use]</code> attribute to
<code>EbpfLogger</code></li>
<li>See full diff in <a
href="30182463bd...ec3eacc1d8">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
In Firezone, a Client requests an "access authorization" for a Resource
on the fly when it sees the first packet for said Resource going through
the tunnel. If we don't have a connection to the Gateway yet, this is
also where we will establish a connection and create the WireGuard
tunnel.
In order for this to work, the access authorization state between the
Client and the Gateway MUST NOT get out of sync. If the Client thinks it
has access to a Resource, it will just route the traffic to the Gateway.
If the access authorization on the Gateway has expired or vanished
otherwise, the packets will be black-holed.
Starting with #9816, the Gateway sends ICMP errors back to the
application whenever it filters a packet. This can happen either because
the access authorization is gone or because the traffic wasn't allowed
by the specific filter rules on the Resource.
With this patch, the Client will attempt to create a new flow (i.e.
re-authorize) traffic for this resource whenever it sees such an ICMP
error, therefore acting as a way of synchronizing the view of the world
between Client and Gateway should they ever run out of sync.
Testing turned out to be a bit tricky. If we let the authorization on
the Gateway lapse naturally, we portal will also toggle the Resource off
and on on the Client, resulting in "flushing" the current
authorizations. Additionally, it the Client had only access to one
Resource, then the Gateway will gracefully close the connection, also
resulting in the Client creating a new flow for the next packet.
To actually trigger this new behaviour we need to:
- Access at least two resources via the same Gateway
- Directly send `reject_access` to the Gateway for this particular
resource
To achieve this, we dynamically eval some code on the API node and
instruct the Gateway channel to send `reject_access`. The connection
stays intact because there is still another active access authorization
but packets for the other resource are answered with ICMP errors.
To achieve a safe roll-out, the new behaviour is feature-flagged. In
order to still test it, we now also allow feature flags to be set via
env variables.
Resolves: #10074
---------
Co-authored-by: Mariusz Klochowicz <mariusz@klochowicz.com>
Bumps the tauri group in /rust/gui-client with 2 updates:
[@tauri-apps/api](https://github.com/tauri-apps/tauri) and
[@tauri-apps/cli](https://github.com/tauri-apps/tauri).
Updates `@tauri-apps/api` from 2.7.0 to 2.8.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tauri-apps/tauri/releases"><code>@tauri-apps/api</code>'s
releases</a>.</em></p>
<blockquote>
<h2><code>@tauri-apps/api</code> v2.8.0</h2>
<!-- raw HTML omitted -->
<pre><code>No known vulnerabilities found
</code></pre>
<!-- raw HTML omitted -->
<h2>[2.8.0]</h2>
<h3>New Features</h3>
<ul>
<li><a
href="68874c68c5"><code>68874c68c</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13564">#13564</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../robertrpf"><code>@robertrpf</code></a>)
Add window focusable attribute and set_focusable API.</li>
<li><a
href="5110a762e9"><code>5110a762e</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13830">#13830</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../Sky-walkerX"><code>@Sky-walkerX</code></a>)
Added <code>Window::setSimpleFullscreen</code>.</li>
</ul>
<h3>Enhancements</h3>
<ul>
<li>
<p><a
href="5ba1c3faa4"><code>5ba1c3faa</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13722">#13722</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../s00d"><code>@s00d</code></a>)
Added icon (icon and nativeIcon) support for Submenu:</p>
<ul>
<li>In the Rust API (<code>tauri</code>), you can now set an icon for
submenus via the builder and dedicated methods.</li>
<li>In the JS/TS API (<code>@tauri-apps/api</code>),
<code>SubmenuOptions</code> now has an <code>icon</code> field, and the
<code>Submenu</code> class provides <code>setIcon</code> and
<code>setNativeIcon</code> methods.</li>
<li>Usage examples are added to the documentation and demo app.</li>
</ul>
<p>This is a backwards-compatible feature. Submenus can now display
icons just like regular menu items.</p>
</li>
</ul>
<!-- raw HTML omitted -->
<pre><code>> @tauri-apps/api@2.8.0 npm-publish
/home/runner/work/tauri/tauri/packages/api
> pnpm build && cd ./dist && pnpm publish --access
public --loglevel silly --no-git-checks
<p>> <code>@tauri-apps/api</code><a
href="https://github.com/2"><code>@2</code></a>.8.0 build
/home/runner/work/tauri/tauri/packages/api
> rollup -c --configPlugin typescript</p>
<p>[36m
[1m./src/app.ts, ./src/core.ts, ./src/dpi.ts, ./src/event.ts,
./src/image.ts, ./src/index.ts, ./src/menu.ts, ./src/mocks.ts,
./src/path.ts, ./src/tray.ts, ./src/webview.ts, ./src/webviewWindow.ts,
./src/window.ts[22m → [1m./dist, ./dist[22m...[39m
[32mcreated [1m./dist, ./dist[22m in [1m1.7s[22m[39m
[36m
[1msrc/index.ts[22m →
[1m../../crates/tauri/scripts/bundle.global.js[22m...[39m
[32mcreated [1m../../crates/tauri/scripts/bundle.global.js[22m in
[1m1.9s[22m[39m
npm verbose cli /opt/hostedtoolcache/node/20.19.4/x64/bin/node
/opt/hostedtoolcache/node/20.19.4/x64/bin/npm
npm info using npm@10.8.2
npm info using node@v20.19.4
npm silly config
load:file:/opt/hostedtoolcache/node/20.19.4/x64/lib/node_modules/npm/npmrc
npm silly config load:file:/tmp/dae4d7dba587bf04d8f1d71cbc53f9eb/.npmrc
npm silly config load:file:/home/runner/work/_temp/.npmrc
</tr></table>
</code></pre></p>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b4abb6cae8"><code>b4abb6c</code></a>
Apply Version Updates From Current Changes (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/13887">#13887</a>)</li>
<li><a
href="1a3d1a024e"><code>1a3d1a0</code></a>
fix(ios): Tauri iOS build with binary XCFramework dependencies (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/13995">#13995</a>)</li>
<li><a
href="37154ebdcd"><code>37154eb</code></a>
chore(deps): update dependency rollup to v4.46.3 (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14027">#14027</a>)</li>
<li><a
href="380656874e"><code>3806568</code></a>
Remove <code>AsRef\<Window></code> on <code>WebviewWindow</code>
(<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14026">#14026</a>)</li>
<li><a
href="bc4afe7dd4"><code>bc4afe7</code></a>
feat(cli): check plugin versions for incompatibilities (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/13993">#13993</a>)</li>
<li><a
href="7c2eb31c83"><code>7c2eb31</code></a>
feat: add <code>PluginHandle::run_mobile_plugin_async</code> (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/13895">#13895</a>)</li>
<li><a
href="737364b8d3"><code>737364b</code></a>
fix: a few regressions from previous PRs (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14020">#14020</a>)</li>
<li><a
href="68874c68c5"><code>68874c6</code></a>
feat(core): webview window focusable property, closes <a
href="https://redirect.github.com/tauri-apps/tauri/issues/11130">#11130</a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/issues/13564">#13564</a>)</li>
<li><a
href="dfadcb764b"><code>dfadcb7</code></a>
feat: add <code>WebView::set_cookie</code> and
<code>WebView::delete_cookie</code> (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/13661">#13661</a>)</li>
<li><a
href="22d6bcacbb"><code>22d6bca</code></a>
feat(tauri): impl <code>App::set_device_event_filter</code> for
<code>AppHandle</code> also (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14008">#14008</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/tauri-apps/tauri/compare/@tauri-apps/api-v2.7.0...@tauri-apps/api-v2.8.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `@tauri-apps/cli` from 2.7.1 to 2.8.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tauri-apps/tauri/releases"><code>@tauri-apps/cli</code>'s
releases</a>.</em></p>
<blockquote>
<h2><code>@tauri-apps/cli</code> v2.8.3</h2>
<h2>[2.8.3]</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="0ac89d3b6c"><code>0ac89d3b6</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/14078">#14078</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../FabianLars"><code>@FabianLars</code></a>)
Updated <code>cargo-mobile2</code> to allow running on iOS simulators
that have a higher version than the XCode SDK. This fixes compatiblity
issues with Apple's recent "iOS 18.5 + iOS 18.6 Simulator"
platform support component.</li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Upgraded to <code>tauri-cli@2.8.2</code></li>
</ul>
<h2><code>@tauri-apps/cli</code> v2.8.2</h2>
<h2>[2.8.2]</h2>
<h3>Dependencies</h3>
<ul>
<li>Upgraded to <code>tauri-cli@2.8.1</code></li>
</ul>
<h2><code>@tauri-apps/cli</code> v2.8.1</h2>
<h2>[2.8.1]</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="f0172a454a"><code>f0172a454</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/14038">#14038</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../KushalMeghani1644"><code>@KushalMeghani1644</code></a>)
Fixes <code>removeDataStore</code> return type.</li>
</ul>
<h2><code>@tauri-apps/cli</code> v2.8.0</h2>
<h2>[2.8.0]</h2>
<h3>New Features</h3>
<ul>
<li><a
href="91508c0b8d"><code>91508c0b8</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13881">#13881</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../pepperoni505"><code>@pepperoni505</code></a>)
Introduces a new configuration option that allows you to specify custom
folders to watch for changes when running <code>tauri dev</code>.</li>
<li><a
href="bc4afe7dd4"><code>bc4afe7dd</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13993">#13993</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../lucasfernog"><code>@lucasfernog</code></a>)
Check installed plugin NPM/crate versions for incompatible
releases.</li>
<li><a
href="0c402bfb6b"><code>0c402bfb6</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13997">#13997</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../lucasfernog"><code>@lucasfernog</code></a>)
Increase default iOS deployment target iOS to 14.0.</li>
<li><a
href="d6d5f37077"><code>d6d5f3707</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13358">#13358</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../lucasfernog"><code>@lucasfernog</code></a>)
Added <code>--root-certificate-path</code> option to <code>android
dev</code> and <code>ios dev</code> to be able to connect to HTTPS dev
servers.</li>
</ul>
<h3>Enhancements</h3>
<ul>
<li><a
href="8b465a12ba"><code>8b465a12b</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13913">#13913</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../FabianLars"><code>@FabianLars</code></a>)
The bundler now pulls the latest AppImage linuxdeploy plugin instead of
using the built-in one. This should remove the libfuse requirement.</li>
<li><a
href="390cb9c36a"><code>390cb9c36</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13953">#13953</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../FabianLars"><code>@FabianLars</code></a>)
Reduced the log level of the binary patcher crate <code>goblin</code> to
only show its debug logs in <code>-vv</code> and above.</li>
<li><a
href="4475e93e13"><code>4475e93e1</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13824">#13824</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../FabianLars"><code>@FabianLars</code></a>)
The bundler and cli will now read TLS Certificates installed on the
system when downloading tools and checking versions.</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="f0dcf9637c"><code>f0dcf9637</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13980">#13980</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../Legend-Master"><code>@Legend-Master</code></a>)
Fix the generated plugin init code of <code>tauri add</code> for
<code>tauri-plugin-autostart</code> and
<code>tauri-plugin-single-instance</code></li>
<li><a
href="4d270a96a8"><code>4d270a96a</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13943">#13943</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../acx0"><code>@acx0</code></a>)
Fix codesigning verification failures caused by binary-patching during
bundling</li>
<li><a
href="b21d86a8a3"><code>b21d86a8a</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13981">#13981</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../Legend-Master"><code>@Legend-Master</code></a>)
Fix <code>tauri permission add</code> could add duplicated permissions
to the capability files</li>
<li><a
href="9c938be452"><code>9c938be45</code></a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/pull/13912">#13912</a>
by <a
href="https://www.github.com/tauri-apps/tauri/../../takecchi"><code>@takecchi</code></a>)
Properly migrate svelte to v5 in the plugin example template</li>
</ul>
<h3>Dependencies</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e81635aa3d"><code>e81635a</code></a>
apply version updates (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14079">#14079</a>)</li>
<li><a
href="0ac89d3b6c"><code>0ac89d3</code></a>
chore(deps): Update cargo-mobile2 for ios 18.6 sim support (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14078">#14078</a>)</li>
<li><a
href="4791d09a0a"><code>4791d09</code></a>
chore(deps): update dependency rollup to v4.48.1 (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14077">#14077</a>)</li>
<li><a
href="bc829ee24d"><code>bc829ee</code></a>
chore(deps): update dependency rollup to v4.48.0 (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14053">#14053</a>)</li>
<li><a
href="11800a0071"><code>11800a0</code></a>
chore(deps): update rust crate jsonschema to 0.33 (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14074">#14074</a>)</li>
<li><a
href="662b39adb3"><code>662b39a</code></a>
apply version updates (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14070">#14070</a>)</li>
<li><a
href="2aaa801c35"><code>2aaa801</code></a>
Improve documentation of <code>app > windows</code> (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14058">#14058</a>)</li>
<li><a
href="5349984064"><code>5349984</code></a>
fix: set webview2 path before initializing runtime (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14054">#14054</a>)</li>
<li><a
href="5f535b4150"><code>5f535b4</code></a>
fix(bench): lint warnings</li>
<li><a
href="f3df96fb38"><code>f3df96f</code></a>
fix(windows): binary patching 32 bit updater type (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/14065">#14065</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/tauri-apps/tauri/compare/@tauri-apps/cli-v2.7.1...@tauri-apps/cli-v2.8.3">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
In order to allow the portal to more easily classify, what kind of
component is connecting, we extend the `get_user_agent` header to
include a component type instead of the generic `connlib/`.
---------
Signed-off-by: Thomas Eizinger <thomas@eizinger.io>
Co-authored-by: Jamil <jamilbk@users.noreply.github.com>
Thomas Eizinger