# Reviewed compatibility backport

The adjacent `../glib` directory contains the complete official `glib` 0.18.5 crate archive,
whose SHA-256 is
`233daaf6e83ae6a12a52055f568f9d7cf4671dabb78ff9560ab6da230ce00ee5`.
The original MIT license, copyright, Cargo metadata and source are retained.

Only `src/variant_iter.rs` differs from upstream: exactly the two-line fix from
https://github.com/gtk-rs/gtk-rs-core/commit/b5a4071e439bef2b5eea76c3aa25e5ae84839e34
changes the C output parameter from `&p` to `&mut p` and makes its local variable
mutable. `SEARCHI-BACKPORT.json` records every original source file's SHA-256
and its patched hash. Searchi provenance records and `.gitattributes` remain outside the upstream tree.

The desktop workspace patches crates.io to this compatible version because
GTK 0.18 cannot use GLib 0.20. This is a local remediation for
RUSTSEC-2024-0429, not an official upstream release or an advisory suppression.
Its registry version still matches the advisory. Do not claim validation before
actual optimized Linux regressions and native desktop checks are recorded.

When upgrading the desktop framework, check whether a compatible upstream
release includes the fix. Remove this override only after the selected complete
Linux dependency graph is safe. Reverify provenance and the exact diff after
any vendor change; keep upstream changes separate from searchi additions.
See `docs/DEPENDENCY-REVIEW.md` and `tools/glib-regression` at the repository root.