chore: linting

src-tauri/.cargo/audit.toml

@@ -1,17 +0,0 @@
-# cargo-audit configuration
-#
-# The ignored advisories below all concern `quick-xml` 0.39.4, which is pulled in
-# ONLY by `wayland-scanner` (Linux clipboard support via arboard →
-# tauri-plugin-clipboard-manager). `wayland-scanner` pins `quick-xml ^0.39`, so
-# no patched release (>= 0.41.0) is reachable through that dependency chain.
-#
-# `wayland-scanner` uses quick-xml at build time to parse the Wayland protocol
-# XML definitions that ship inside the crate — trusted, bundled input, never
-# attacker-controlled — so the denial-of-service vectors these advisories
-# describe do not apply. Our own direct dependency is already on the patched
-# quick-xml 0.41. Remove these entries once wayland-scanner bumps its requirement.
-[advisories]
-ignore = [
-  "RUSTSEC-2026-0194", # quick-xml: quadratic runtime on duplicate start-tag attribute names
-  "RUSTSEC-2026-0195", # quick-xml: unbounded namespace-declaration allocation in NsReader
-]

src-tauri/Cargo.lock

@@ -7904,8 +7904,9 @@ dependencies = [
 
 [[package]]
 name = "wayland-scanner"
-version = "0.31.10"
-source = "git+https://github.com/Smithay/wayland-rs?rev=d07c4f91f28b42e5a485823ffd9d8d5a210b1053#d07c4f91f28b42e5a485823ffd9d8d5a210b1053"
+version = "0.31.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0"
 dependencies = [
  "proc-macro2",
  "quick-xml",

src-tauri/Cargo.toml

@@ -187,9 +187,3 @@ default = ["custom-protocol"]
 # DO NOT remove this
 custom-protocol = ["tauri/custom-protocol"]
 e2e = []
-
-# wayland-scanner 0.31.10 still pins vulnerable quick-xml 0.39. Upstream fixed
-# RUSTSEC-2026-0194 and RUSTSEC-2026-0195, but has not published the fix yet.
-# Remove this patch after the next wayland-scanner release is in the lockfile.
-[patch.crates-io]
-wayland-scanner = { git = "https://github.com/Smithay/wayland-rs", rev = "d07c4f91f28b42e5a485823ffd9d8d5a210b1053" }

src-tauri/src/app_auto_updater.rs

@@ -1742,16 +1742,16 @@ impl AppAutoUpdater {
     let proxy_ids: Vec<String> = proxy_configs.into_iter().map(|config| config.id).collect();
     let vpn_ids: Vec<String> = vpn_configs.into_iter().map(|config| config.id).collect();
 
-    let stop_proxies = futures_util::future::join_all(
-      proxy_ids
-        .iter()
-        .map(|id| crate::proxy_runner::stop_proxy_process(id)),
-    );
-    let stop_vpns = futures_util::future::join_all(
-      vpn_ids
-        .iter()
-        .map(|id| crate::vpn_worker_runner::stop_vpn_worker(id)),
-    );
+    let stop_proxies = futures_util::future::join_all(proxy_ids.iter().map(|id| async move {
+      crate::proxy_runner::stop_proxy_process(id)
+        .await
+        .map_err(|error| error.to_string())
+    }));
+    let stop_vpns = futures_util::future::join_all(vpn_ids.iter().map(|id| async move {
+      crate::vpn_worker_runner::stop_vpn_worker(id)
+        .await
+        .map_err(|error| error.to_string())
+    }));
     let (proxy_results, vpn_results) = tokio::join!(stop_proxies, stop_vpns);
 
     for result in proxy_results.into_iter().chain(vpn_results) {
@@ -2326,6 +2326,13 @@ not-a-hash  Donut_0.29.0_amd64.deb
     assert!(hooks.contains("Delete \"$INSTDIR\\donut-proxy.exe\""));
   }
 
+  #[test]
+  fn test_windows_installer_preparation_future_is_send() {
+    fn assert_send<T: Send>(_: T) {}
+
+    assert_send(AppAutoUpdater::prepare_windows_installer());
+  }
+
   #[test]
   fn test_platform_specific_download_urls() {
     let updater = AppAutoUpdater::instance();