chore(deps,core,gui): upgrade dependencies to latest

- keyring 3 -> keyring-core 1 + dbus-secret-service-keyring-store 1
  (crypto-rust). Same libdbus Secret Service backend; with no target the
  store matches items keyring 3 wrote, so stored sessions survive.
- ksni 0.2 -> 0.3 via the blocking API, with assume_sni_available so a
  tray that starts before the SNI watcher waits instead of failing. Drops
  the clap 2 / atty chain (Dependabot atty advisory).
- gtk4 0.11, libadwaita 0.9, webkit6 0.6, rusqlite 0.40, fuser 0.18,
  directories 6, sha1/sha2 0.11, base64 0.23.

crates/pdfs-core/Cargo.toml

@@ -23,7 +23,8 @@ sha2.workspace = true
 sha1.workspace = true
 zip.workspace = true
 rusqlite.workspace = true
-keyring.workspace = true
+keyring-core.workspace = true
+dbus-secret-service-keyring-store.workspace = true
 parking_lot.workspace = true
 async-trait.workspace = true
 libc.workspace = true

crates/pdfs-core/src/auth.rs

@@ -6,7 +6,7 @@
 //! interactive step; the refresh token auto-renews via the HTTP client's 401
 //! path, so no fresh 2FA is required until the refresh token itself expires.
 
-use keyring::Entry;
+use keyring_core::Entry;
 use proton_drive_rs::{KeySalt, ProtonDriveClient};
 use proton_sdk::api::{HumanVerification, HumanVerificationCredential};
 use proton_sdk::cache::EncryptedCacheRepository;
@@ -81,6 +81,11 @@ fn client_config() -> ProtonClientConfiguration {
 }
 
 fn keyring_entry() -> Result<Entry> {
+    // Installed lazily rather than once at startup so a session bus that was not
+    // up yet on the first attempt is retried on the next one.
+    if keyring_core::get_default_store().is_none() {
+        keyring_core::set_default_store(dbus_secret_service_keyring_store::Store::new()?);
+    }
     Ok(Entry::new(KEYRING_SERVICE, KEYRING_USER)?)
 }
 
@@ -215,7 +220,7 @@ pub fn load() -> Result<StoredSession> {
     let entry = keyring_entry()?;
     match entry.get_password() {
         Ok(json) => Ok(serde_json::from_str(&json)?),
-        Err(keyring::Error::NoEntry) => Err(Error::NotLoggedIn),
+        Err(keyring_core::Error::NoEntry) => Err(Error::NotLoggedIn),
         Err(e) => Err(e.into()),
     }
 }
@@ -238,7 +243,7 @@ pub fn logout() -> Result<()> {
         }
     }
     match keyring_entry()?.delete_credential() {
-        Ok(()) | Err(keyring::Error::NoEntry) => Ok(()),
+        Ok(()) | Err(keyring_core::Error::NoEntry) => Ok(()),
         Err(e) => Err(e.into()),
     }
 }

crates/pdfs-core/src/error.rs

@@ -11,7 +11,7 @@ pub enum Error {
     Proton(#[from] proton_sdk::ProtonError),
 
     #[error("keyring: {0}")]
-    Keyring(#[from] keyring::Error),
+    Keyring(#[from] keyring_core::Error),
 
     #[error("serialization: {0}")]
     Serde(#[from] serde_json::Error),

crates/pdfs-gui/Cargo.toml

@@ -29,9 +29,9 @@ anyhow.workspace = true
 tokio.workspace = true
 serde.workspace = true
 serde_json.workspace = true
-ksni = "0.2"
-gtk4 = { version = "0.9", features = ["v4_12"] }
-adw = { package = "libadwaita", version = "0.7", features = ["v1_5"] }
+ksni = { version = "0.3", features = ["blocking"] }
+gtk4 = { version = "0.11", features = ["v4_12"] }
+adw = { package = "libadwaita", version = "0.9", features = ["v1_5"] }
 async-channel = "2"
 exif = { version = "0.6", package = "kamadak-exif" }
-webkit6 = "0.4"
+webkit6 = "0.6"

crates/pdfs-gui/src/main.rs

@@ -14,8 +14,9 @@ use std::process::Command;
 use std::time::Duration;
 
 use anyhow::{Context, Result};
+use ksni::blocking::TrayMethods;
 use ksni::menu::StandardItem;
-use ksni::{MenuItem, Tray, TrayService};
+use ksni::{MenuItem, Tray};
 use pdfs_core::auth;
 use pdfs_core::config::AppDirs;
 use pdfs_core::control::{
@@ -282,13 +283,13 @@ fn main() -> Result<()> {
         state: poll_state(&socket, &default_mountpoint),
     };
 
-    let service = TrayService::new(tray);
-    let handle = service.handle();
-    std::thread::spawn(move || {
-        if let Err(e) = service.run() {
-            tracing::error!("tray service stopped: {e:?}");
-        }
-    });
+    // The tray autostarts with the session and can beat the desktop's SNI
+    // watcher onto the bus. Without `assume_sni_available` that race is a hard
+    // spawn error; with it the item waits and registers once the watcher shows.
+    let handle = tray
+        .assume_sni_available(true)
+        .spawn()
+        .context("start tray service")?;
 
     // Poll the daemon forever, pushing each fresh snapshot into the tray so the
     // menu reflects mount/login changes made elsewhere (e.g. via the CLI).

crates/pdfs-gui/src/prompt.rs

@@ -1364,7 +1364,7 @@ fn icon_for(name: &str, is_dir: bool) -> gio::Icon {
     if is_dir {
         return gio::ThemedIcon::new("folder").upcast();
     }
-    let (content_type, _uncertain) = gio::functions::content_type_guess(Some(name), &[]);
+    let (content_type, _uncertain) = gio::functions::content_type_guess(Some(name), None);
     gio::functions::content_type_get_icon(&content_type)
 }