Chatpane / Tickets / #291 build(deps): update dependencies and backport menu safety fix

Originally posted by: chatgpt-codex-connector[bot]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed <relative-time datetime="2026-09-21T15:54:00.846026Z">2026-09-21T15:54:00.846026Z</relative-time>	`dac2aee`	Manual request

ℹ️ About Codex in GitHub

[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you - Open a pull request for review - Mark a draft as ready - Comment "@codex review" or "@codex security review". Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

Originally posted by: coderabbitai[bot]

Understand this PR’s impact

Explore downstream dependencies and potential security impact with Blast Radius.

View blast radius →

📝 Walkthrough

## Walkthrough This PR vendors the `muda` menu library into `src-tauri`, patches Cargo to use it, adds a macOS lifecycle validation example, updates CI to run that example, requires signed updater versions, and passes an explicit app version during release signing. ### Changes **Vendored muda integration** |Layer / File(s)|Summary| |---|---| |**Build, release, and app wiring**
`.github/workflows/*`, `package.json`, `src-tauri/Cargo.toml`, `src-tauri/tauri.conf.json`|CI updates `cargo-audit`, runs `menu_lifecycle` on macOS, release signing now passes `--app-version` from the tag, `@tauri-apps/cli` is bumped, `tauri-plugin-updater` is pinned to `2.12`, Cargo now patches `muda` from `src-tauri/vendor/muda`, and the updater config sets `"requireSignedVersion": true`.| |**Vendored crate package and public API**
`src-tauri/vendor/muda/Cargo.toml`, `src-tauri/vendor/muda/LICENSE*`, `src-tauri/vendor/muda/README.md`, `src-tauri/vendor/muda/src/{about_metadata,accelerator,error,icon,lib,menu_id,platform_impl/mod,util}.rs`|The vendored `muda` crate adds package metadata, licenses, crate docs, shared error and utility types, accelerator parsing, icon types, about-dialog metadata, `MenuId`, `MenuEvent`, `ContextMenu`, `MenuItemKind`, and platform selection for Windows, macOS, and GTK targets.| |**Menu items, builders, and top-level menu API**
`src-tauri/vendor/muda/src/builders/*`, `src-tauri/vendor/muda/src/items/*`, `src-tauri/vendor/muda/src/menu.rs`|The crate now exposes builders for normal, check, icon, and submenu items; public `MenuItem`, `CheckMenuItem`, `IconMenuItem`, `PredefinedMenuItem`, and `Submenu` types; and the top-level `Menu` wrapper with item management and platform-gated window integration methods.| |**GTK backend**
`src-tauri/vendor/muda/src/platform_impl/gtk/*`|The GTK backend adds menu and submenu storage, accelerator registration, icon rendering, predefined item handling, context-menu display, menu-bar window lifecycle, check-item synchronization, and `MenuEvent` dispatch for GTK widgets.| |**macOS backend and lifecycle validation**
`src-tauri/vendor/muda/src/platform_impl/macos/*`, `src-tauri/examples/menu_lifecycle.rs`, `src-tauri/vendor/README.md`|The macOS backend adds native menu integration, accelerator and icon helpers, native menu item lifecycle management, event dispatch, and context-menu support. The new `menu_lifecycle` example validates event delivery after Rust handles are dropped and checks native item release after the retained handle is dropped. The vendor README documents the backported ownership fix and the example.| |**Windows backend**
`src-tauri/vendor/muda/src/platform_impl/windows/*`|The Windows backend adds Win32 menu and submenu integration, accelerator tables, icon conversion, dark menu-bar drawing, DPI helpers, predefined actions, about-dialog handling, subclass dispatch, and `MenuEvent` routing for menu commands.| **Priority:** ⬇️ Low **Estimated code review effort:** 5 (Critical) | ~120 minutes **Change:** Other ### Sequence Diagram(s) :::mermaid sequenceDiagram participant User participant NativeMenu as Native menu backend participant Muda as muda Menu/MenuChild participant App as Carrier app User->>NativeMenu: select menu item NativeMenu->>Muda: resolve item and update state Muda->>App: send MenuEvent(MenuId)

Merge Risk: 🔵 Low · up to dac2a

Correct the vendored literals and GTK icon validation before merging; both issues are localized and straightforward to fix.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

### ❌ Failed checks (1 warning) | Check name | Status | Explanation | Resolution | | :----------------: | :--------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------- | | Docstring Coverage | ⚠️ Warning | Docstring coverage is 45.22% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 502 functions across 33 files. (11 skippe… | Write docstrings for the functions missing them to satisfy the coverage threshold. |

✅ Passed checks (4 passed)

Full details: Docstring Coverage

**Explanation** Docstring coverage is 45.22% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 502 functions across 33 files. (11 skipped: 11 unsupported.)

[ ] Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

- [ ] Commit to this branch - [ ] Create a new PR

🧪 Generate unit tests (beta)

- [ ] Commit to this branch - [ ] Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai) - [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai) - [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai) - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)

_{Comment @coderabbitai help to get the list of available commands.}

build(deps): update dependencies and backport menu safety fix

Facebook Messenger on your desktop, without the Facebook clutter

Milestone

Searches

Help

#291 build(deps): update dependencies and backport menu safety fix

Summary by CodeRabbit

Related

Discussion

Codex Review Summary