Dependencies

A curated list of the major external dependencies the Tauri workspace depends on, and where they enter the system.

Rust workspace

Window/webview backbone

Crate	Where used	Why
tao	crates/tauri-runtime-wry	Native window creation; fork of winit. Used via re-export from wry.
wry	crates/tauri-runtime-wry	Cross-platform webview abstraction (WKWebView/WebView2/WebKitGTK/Android WebView).
gtk / webkit2gtk	crates/tauri (linux), tauri-runtime-wry	Linux GTK + WebKitGTK bindings.
objc2*	crates/tauri (apple), tauri-runtime-wry	macOS / iOS Objective-C runtime bindings (AppKit, WebKit, UIKit, Foundation).
windows	crates/tauri (windows), tauri-runtime-wry	Windows API.
webview2-com	crates/tauri (windows)	WebView2 COM bindings.

UI accessories

Crate	Where used	Why
muda	crates/tauri (desktop)	Desktop menus.
tray-icon	crates/tauri (tray-icon feature)	System tray.
window-vibrancy	crates/tauri (mac/win)	Native window blur/vibrancy.

Async, IPC, serialization

Crate	Where used	Why
tokio	crates/tauri	Async runtime under tauri::async_runtime.
serde + serde_json	everywhere	Config + IPC serialization.
serialize-to-javascript	crates/tauri	Safe stringification of Rust values into JS callbacks.
cookie	crates/tauri-runtime, crates/tauri	Cookie type re-exported through the runtime trait.
http	crates/tauri, tauri-runtime	HTTP types for custom protocol handlers.

Build-time and macros

Crate	Where used	Why
syn, quote, proc-macro2	crates/tauri-macros, crates/tauri-codegen	Proc-macro plumbing.
schemars	crates/tauri-utils (schema feature), crates/tauri-schema-generator	JSON Schema derive. Patched fork preserves docstring newlines.
phf	crates/tauri-codegen	Compile-time perfect hash maps for embedded assets.
handlebars	crates/tauri-cli, tauri-bundler	Template rendering for installer scripts.

CLI

Crate	Where used	Why
clap	crates/tauri-cli	Argument parsing.
dialoguer	crates/tauri-cli	Interactive prompts.
os_pipe	crates/tauri-cli	Shared stdio between parent and child processes.
env_logger	crates/tauri-cli	Structured CLI logs.
napi-rs	packages/cli	Rust → Node addon for @tauri-apps/cli.

Bundler

Crate	Where used	Why
tar, flate2	tauri-bundler	Updater archive format.
glob	tauri-bundler, tauri-utils	Resource walking.
minisign-verify	(bundled by tauri-plugin-updater, generated in this repo)	Updater signature verification.
image	crates/tauri-cli, tauri-bundler, tauri	Icon generation.

Workspace policy

• Patches to crates.io-published deps are listed in the root Cargo.toml [patch.crates-io] block. Currently used for the schemars newline fork and to redirect tauri/tauri-plugin/tauri-utils to the local paths so workspace cycles resolve.
• Dependency churn is automated via Renovate (renovate.json) and Dependabot (dependabot.yml). Approximately 22% of all commits are bot-authored.
• Supply chain audits are tracked under audits/ and the cargo-vet config lives in supply-chain/. CI workflow supply-chain.yml enforces this.

npm packages

The pnpm side is intentionally small.

Package	Where used	Why
rollup + @rollup/plugin-typescript	packages/api	Build the dual ESM/CJS bundle.
typescript	every TS package	Build/typecheck.
eslint + eslint-plugin-security	every TS package	Lint.
prettier	root	Format non-Rust files.
vitest	packages/api	Unit tests.
napi-rs toolchain	packages/cli	Native addon build.
Cloudflare Workers types	crates/tauri-schema-worker	The Worker runtime types.

The full set is in each package's package.json and the root pnpm-lock.yaml (170 KB — Renovate keeps it busy).