chore(mesh): upgrade MeshLLM to 0.76.0 - #7559
Draft
micspiral wants to merge 2 commits into
Draft
Conversation
Pin the desktop and relay smoke dependencies to the stable release and regenerate both lockfiles. Match its Ed25519 and SQLite dependencies, retaining unsigned SQL conversions in non-mesh desktop builds. Use the merged SQLx SQLite compatibility fix until a crates.io release includes transact-rs/sqlx#4402. The PostgreSQL driver remains on crates.io SQLx 0.9.0. Signed-off-by: Thinker <75d8a808fa21bb8d1812e080cf471db601c6e8e6a62dcd516d37531e83a7bb77@meshllm.communities.buzz.xyz>
🔐 Codex Security Review
|
micspiral
marked this pull request as draft
September 11, 2026 01:21
Collaborator
Author
CI follow-up: not readyMarking this PR draft until the GitHub CI failures are resolved. Local validation and PR creation were not sufficient completion evidence. At head
One same-head rerun is in progress. A retry passing will not alone establish that the original failures were unrelated. No tests, dependency pins, or CI limits have been changed to make this pass during follow-up. |
Two follow-ups to the MeshLLM 0.76.0 upgrade, both consequences of the same thing: Buzz was relying on Cargo feature/dependency unification with mesh-llm rather than declaring what it needs. 1. Linux Secret Service sessions dropped to plaintext. Until 0.76, mesh-llm enabled `crypto-rust` on the *same* keyring 3 the desktop uses, so Buzz inherited it through feature unification. 0.76 moves mesh-llm to keyring 4, and desktop's own declaration only asked for `sync-secret-service,vendored`. `keyring-3.6.3/src/secret_service.rs:140-143,333-336` selects `EncryptionType::Dh` only under a crypto feature and `Plain` otherwise, so Linux mesh-enabled builds lost Diffie-Hellman transit encryption for nsec reads/writes over the D-Bus session bus. Visible in the lockfile: `dbus-secret-service 4.1.0` lost aes/block-padding/cbc/hkdf/sha2/num/ fastrand/once_cell. Fixed by requesting `crypto-rust` explicitly. It restores exactly the packages the pre-upgrade lock already had, so it costs nothing. 2. Desktop E2E Relay exceeded its 30 minute timeout. The mesh-llm SDK and native runtime were dev-dependencies of `buzz-relay`. A dev-dependency feeds *every* target of its package, so `cargo nextest archive -p buzz-relay` had to compile the whole mesh-llm + skippy + rmcp + hf-xet tree before a single relay unit test could build — and the mesh pin bump invalidated that cache wholesale. The six harnesses that need it are examples that drive the relay as an external process; none reference `buzz_relay::`. Moved them to a new examples-only crate `buzz-mesh-smoke` so the cost lands only on the Mesh Lifecycle workflow that actually runs them. buzz-relay's dev graph: 692 -> 453 packages, with zero mesh-llm, skippy, rmcp, hf-xet or keyring entries remaining. Verified: `cargo clippy -p buzz-mesh-smoke -p buzz-relay --all-targets -- -D warnings` clean; all six harnesses compile in the new crate; `cargo test -p buzz-relay --lib` 1034 passed, with 6 pre-existing `Sqlx(PoolTimedOut)` media tests that require Postgres (not run locally). Not verified locally: Linux keyring runtime behaviour and the Mesh Lifecycle smoke, both of which need CI. Co-authored-by: Michael Neale <michael.neale@gmail.com> Signed-off-by: Michael Neale <michael.neale@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upgrade Buzz from MeshLLM
v0.76.0-rc9to the stable v0.76.0 release, based on freshly fetched main051c3a270be9c73da9ab06700bcab7d5552fceaa.557630fd0a543aecd2f2b8ef5232ec1829865115.ed25519-dalek = 3.0.0andrusqlite = 0.40dependencies.fallible_uintfeature, preserving Buzz's existingu64SQL conversions when mesh is disabled. Mesh-enabled builds previously supplied this transitively, so testing both configurations matters.sqlx-sqlitepackage to the merged upstream compatibility fix transact-rs/sqlx#4402, revision94aafe3a68884d923b0798a767c8d7f6cfda89d2. SQLx 0.9.0 capslibsqlite3-sysbelow 0.38, while Mesh 0.76 requires 0.38. Cargo resolves the conflict even with SQLite disabled. The fix raises that upper bound; remove the patch once released. Buzz's active PostgreSQL driver stays on crates.io SQLx 0.9.0.cargo tree --locked --workspace --target all -i sqlx-sqlitereports no active consumers.Five manifest/lockfile changes only; no application-source, schema, admission-policy, model-selection, or UI changes. No running application was replaced.
Related issue
No open stable-0.76 upgrade issue/PR found in the title search. Follows the earlier RC integration in #6189.
Originating Buzz conversation: buzz://message?channel=dffbc117-845a-4c02-bc3f-eaeeefc4deaa&id=670f9c262e1ec0a4df5600b3173a0c5de2abe17e08ba9ccfdd8eff109fadf1a8
Testing
Local macOS ARM64, repository Hermit toolchain:
just cion the final working-tree patch before commit, including workspace Clippy and both desktop cfg graphs with-D warnings, repository formatting/static checks, Rust/desktop/mobile unit tests, and desktop/web builds.5595d99dd0df0c9a36e08646b2372e32d886a3c6:cargo test --locked --manifest-path desktop/src-tauri/Cargo.toml --features mesh-llm --workspace— 3,279 desktop tests plus all terminal/integration suites; 21 tests ignored across the workspace.git diff --check.cargo test --locked -p buzz-relayrun on the pre-commit upgrade tree compiled but had 1,034 passed / 6 failed / 89 ignored. All six failures were media-test setup atcrates/buzz-relay/src/api/media.rs:1145, waiting to seed a PostgreSQL community (Sqlx(PoolTimedOut)). Docker is unavailable in this local session. This is disclosed separately from the repository's infra-freejust cigate; no tests were changed or suppressed.