tauri-apps / tauri-apps/plugins-workspace

@tauri-apps/plugin-http JS 2.5.5+ silently breaks when Rust side is pinned to 2.5.4 — fetch_read_body IPC mismatch

Open
#3,276 2 comments 0 reactions 0 assignees View on GitHub
plugin: http
Dominant language
Rust
Stars
1.8k
Forks
602
Avg merge
4d 14h
Merged PRs (30d)
9

Description

## Problem

`plugin-http` `2.5.5` changed `fetch_read_body` from a `Channel`-based streaming API to returning `tauri::ipc::Response` directly (PR #2562). This is a breaking IPC contract change — the JS and Rust sides must be updated together.

However, if a project has the JS package at `2.5.5+` (via a loose `^2.5.x` specifier in `package.json`) but the Rust crate pinned to `2.5.4` in `Cargo.lock`, every `fetch` call silently fails with:

```
invalid args `streamChannel` for command `fetch_read_body`: command fetch_read_body missing required key streamChannel
```

The Rust side expects the old `streamChannel` arg; the JS side no longer sends it.

## Why it's hard to notice

- `cargo update` won't pull `2.5.5+` unprompted if the lock is already satisfied
- `bun install` / `npm install` *will* pull the latest matching JS version on a clean install (e.g. after clearing `node_modules`)
- The error surfaces as a Tauri IPC error thrown *inside* third-party SDK fetch calls (e.g. Groq, OpenAI), which don't recognise it as their own error type — it gets re-thrown and swallowed as an unhandled promise rejection with no user-visible message
- CI pipelines that don't run a full desktop Tauri build won't catch it

## Steps to reproduce

1. Create a Tauri 2 app using `@tauri-apps/plugin-http`
2. Pin `Cargo.lock` to `tauri-plugin-http = "2.5.4"` (e.g. don't run `cargo update` after bumping the JS package)
3. Install JS deps fresh with `@tauri-apps/plugin-http@^2.5.1` — resolves to `2.5.7`
4. Call `fetch` via `tauriFetch` from the JS plugin
5. Observe silent failure / IPC error

## Expected behaviour

Either:
- **The patch version should not contain breaking IPC changes** — the `fetch_read_body` signature change should have been a minor bump (`2.6.0`), or
- **The JS and Rust packages should declare peer version constraints** so that a mismatch is caught at install time rather than silently at runtime

## Actual behaviour

`fetch` calls silently fail with an IPC arg validation error that is not surfaced to the user.

## Environment

- `@tauri-apps/plugin-http` JS: `2.5.7`
- `tauri-plugin-http` Rust: `2.5.4`
- Tauri: `2.x`
- OS: Linux

## Suggested fix

At minimum, document that `2.5.5` contains a coordinated JS+Rust change and that `Cargo.lock` must be updated when bumping the JS package past `2.5.4`. Ideally:

- Reserve patch versions for truly non-breaking changes and use minor bumps for IPC contract changes
- Or add a Rust-side version handshake that returns a descriptive error when the IPC protocol version doesn't match, rather than a raw arg validation failure

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.