Possible fix(deps): tauri 2.10.3 → 2.11.1 (CVE-2026-42184) in Cargo.lock

[begininvoke]

This might be a false positive, but src-tauri/Cargo.lock around line 5277 looked worth a second pair of eyes.

CVE-2026-42184 exposes a flawed subdomain validation in Tauri's is_local_url() function on Windows and Android. When custom URI schemes are mapped to http://<scheme>.localhost/, the local-origin check only inspects the first subdomain. An attacker who controls a domain matching your app's custom scheme subdomain can bypass local-only restrictions, potentially accessing protected internal resources, exfiltrating sensitive data, or breaking context isolation boundaries. Risk Level: Medium/High.

Something like this might fix it:

Upgrade the Tauri dependency to >=2.11.1 and regenerate the lockfile.

```diff
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -X,X +X,X @@
 [package]
 name = "your-app"

 [dependencies]
-tauri = "2.10.3"
+tauri = ">=2.11.1"
 ```

After applying the version bump, run:
`cargo update -p tauri`
to resolve the patched version in `Cargo.lock` and rebuild your application.

For reference: rule CVE-2026-42184. Rated high.

The suggested change is untested against this project, so please read it before applying it.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.