tauri-apps / tauri-apps/plugins-workspace
@tauri-apps/plugin-http JS 2.5.5+ silently breaks when Rust side is pinned to 2.5.4 — fetch_read_body IPC mismatch
- Dominant language
- Rust
- Stars
- 1.8k
- Forks
- 602
- Avg merge
- 4d 14h
- Merged PRs (30d)
- 9
Description
## Problem
`plugin-http` `2.5.5` changed `fetch_read_body` from a `Channel`-based streaming API to returning `tauri::ipc::Response` directly (PR #2562). This is a breaking IPC contract change — the JS and Rust sides must be updated together.
However, if a project has the JS package at `2.5.5+` (via a loose `^2.5.x` specifier in `package.json`) but the Rust crate pinned to `2.5.4` in `Cargo.lock`, every `fetch` call silently fails with:
```
invalid args `streamChannel` for command `fetch_read_body`: command fetch_read_body missing required key streamChannel
```
The Rust side expects the old `streamChannel` arg; the JS side no longer sends it.
## Why it's hard to notice
- `cargo update` won't pull `2.5.5+` unprompted if the lock is already satisfied
- `bun install` / `npm install` *will* pull the latest matching JS version on a clean install (e.g. after clearing `node_modules`)
- The error surfaces as a Tauri IPC error thrown *inside* third-party SDK fetch calls (e.g. Groq, OpenAI), which don't recognise it as their own error type — it gets re-thrown and swallowed as an unhandled promise rejection with no user-visible message
- CI pipelines that don't run a full desktop Tauri build won't catch it
## Steps to reproduce
1. Create a Tauri 2 app using `@tauri-apps/plugin-http`
2. Pin `Cargo.lock` to `tauri-plugin-http = "2.5.4"` (e.g. don't run `cargo update` after bumping the JS package)
3. Install JS deps fresh with `@tauri-apps/plugin-http@^2.5.1` — resolves to `2.5.7`
4. Call `fetch` via `tauriFetch` from the JS plugin
5. Observe silent failure / IPC error
## Expected behaviour
Either:
- **The patch version should not contain breaking IPC changes** — the `fetch_read_body` signature change should have been a minor bump (`2.6.0`), or
- **The JS and Rust packages should declare peer version constraints** so that a mismatch is caught at install time rather than silently at runtime
## Actual behaviour
`fetch` calls silently fail with an IPC arg validation error that is not surfaced to the user.
## Environment
- `@tauri-apps/plugin-http` JS: `2.5.7`
- `tauri-plugin-http` Rust: `2.5.4`
- Tauri: `2.x`
- OS: Linux
## Suggested fix
At minimum, document that `2.5.5` contains a coordinated JS+Rust change and that `Cargo.lock` must be updated when bumping the JS package past `2.5.4`. Ideally:
- Reserve patch versions for truly non-breaking changes and use minor bumps for IPC contract changes
- Or add a Rust-side version handshake that returns a descriptive error when the IPC protocol version doesn't match, rather than a raw arg validation failure
Contributor guide
Assessment
This issue has not been assessed yet.