[dylanmtaylor]

Follow-up to the startup update prompt PR: that merged on craft-libs 5b0f3c5, before the fix that keeps the close request pending while the app holds unsaved work (storytold/craft-libs#333). This moves the pin to db19c37, which also has the Windows helper's executable-name check and the zip 9 / dirs-free build.

Part of tracking issue storytold/craft-libs#319

Summary by CodeRabbit

• Chores
  • Updated an underlying integration revision. No user-facing changes are included in this update.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The workspace updates the pinned Git revision for craft-update. Its Git URL, version constraint, and egui feature remain unchanged.

Changes: Dependency revision

Layer / File(s)	Summary
Update craft-update revision Cargo.toml	The craft-update Git revision changes from 5b0f3c572a3b5c1e51bdb90d7ff788e0212ec1cc to db19c373c8d59a545972ca340987aecfb3611a4b.

Priority: Not assessed

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Possibly related PRs

• storytold/deckcraft#1377: Adds the startup update prompt and self-updating through craft-update, the dependency updated here.

Suggested reviewers: skylartaylor

Merge Risk: Minimal · up to 78c01

No actionable merge-blocking risk is evident from the supplied change context.

Security architecture risk: Low · up to 78c01

The application’s existing update entry points remain unchanged, and no introduced vulnerability was established. However, the upstream implementation could not be inspected, leaving update verification, executable-target checks, and interruption recovery unconfirmed.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The directly evidenced exposure is the existing native application's command-line finalizer and update UI. The brief characterizes the finalizer as a user-to-user execution boundary without a privilege change, but the unavailable helper implementation prevents independently bounding executable targets, downstream authority, or maximum replacement scope.

Trust Boundaries and Controls

• observed — The local startup caller delegates finalization to craft-update rather than implementing artifact authentication or executable-target authorization itself. The supplied proof gaps leave both the old and new implementations unresolved, so the stated Windows executable-name check cannot be treated as a verified control improvement or evidence of a newly introduced weakness.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}