Tauri 1

Apply the Rust 1.98 baseline first, including its requirement to use a fixed, supported compiler for production. These rules target Tauri 1 and its desktop APIs, and were checked against Tauri core 1.8.3. The core crate declares Rust 1.60 as its minimum; validate the actual locked dependency graph and target platform with the chosen compiler.

Version and dependency boundary

• Lock the tauri crate and compatible v1 tauri-build, CLI, @tauri-apps/api, and plugin releases in Cargo.lock and the JavaScript lock file, and update them as one group; their version numbers need not match. Do not substitute v2 capabilities, permissions files, or plugin contracts for v1 controls.
• Audit the resolved Rust, npm, sidecar, and native-library graph. Evaluate the legacy GTK3, atty, instant, and glib findings against the shipped graph; the historical release audit and Tauri's support policy do not establish that transitive dependencies remain safe.
• Keep Windows WebView2, macOS WebKit, and Linux WebKitGTK patched independently of Tauri. Maintain any bundled fixed WebView2 runtime yourself and deploy only on operating systems still receiving security updates.
• Review the merged platform-specific configuration, CLI --config overrides, and Cargo features used for each release. Exclude api-all, unnecessary module-wide features, and release devtools; never disable the WebView sandbox or web security through additionalBrowserArgs.

Command IPC and authorization

• Expose only necessary commands through invoke_handler and generate_handler!; treat each