Skip to content

chore(mesh): upgrade MeshLLM to 0.76.2 - #7559

Open
micspiral wants to merge 6 commits into
mainfrom
micspiral/mesh-0.76.0
Open

chore(mesh): upgrade MeshLLM to 0.76.2#7559
micspiral wants to merge 6 commits into
mainfrom
micspiral/mesh-0.76.0

Conversation

@micspiral

@micspiral micspiral commented Sep 10, 2026 •
edited by michaelneale
Loading

Copy link
Copy Markdown
Collaborator

Summary

Upgrade Buzz from MeshLLM v0.76.0-rc9 to the latest stable v0.76.2 release (via v0.76.1).

  • Update all eight Mesh git dependencies across desktop and relay smoke examples; both lockfiles resolve all 47 Mesh packages to a0c1e66b0ac037dd56544b9e2d94969ea43d694f (tag v0.76.2). All non-Mesh lock records are unchanged by the 0.76.1 → 0.76.2 bump.
  • Match Mesh's ed25519-dalek = 3.0.0 and rusqlite = 0.40 dependencies.
  • Explicitly enable rusqlite's fallible_uint feature, preserving Buzz's existing u64 SQL conversions when mesh is disabled. Mesh-enabled builds previously supplied this transitively, so testing both configurations matters.
  • Temporarily pin only the optional sqlx-sqlite package to the merged upstream compatibility fix transact-rs/sqlx#4402, revision 94aafe3a68884d923b0798a767c8d7f6cfda89d2. SQLx 0.9.0 caps libsqlite3-sys below 0.38, while Mesh 0.76 requires 0.38. Cargo resolves the conflict even with SQLite disabled. The fix raises that upper bound; remove the patch once released. Buzz's active PostgreSQL driver stays on crates.io SQLx 0.9.0.
  • Preserve the explicit Linux keyring 3 crypto-rust feature so Secret Service sessions retain DH encryption independently of Mesh keyring 4.
  • Preserve the dedicated examples-only buzz-mesh-smoke crate and lifecycle workflow wiring, keeping Mesh/native-runtime dev dependencies out of relay CI builds.
  • v0.76.1 → v0.76.2 upstream delta: self-updater fix for composed product-v2 bundles (fix(autoupdate): install composed product-v2 bundles in the self-updater Mesh-LLM/mesh-llm#1844) plus release plumbing — no API changes affecting Buzz.
  • Merged origin/main (7c789dee0) without rewriting shared PR history.

Validation at ae4adba15 (local macOS ARM64, Hermit toolchain)

  • Passed: cargo test --locked -p buzz-mesh-smoke --all-targets (all six example harnesses compile; no live harness execution).
  • Passed: desktop Tauri workspace tests, both default and --features mesh-llm graphs (3,296 tests with mesh enabled, 0 failures).
  • Passed: just desktop-tauri-clippy (both feature graphs, -D warnings), root workspace clippy -D warnings, cargo fmt --all --check.
  • Passed: --locked metadata resolution for both workspaces; lockfile diff audited to touch only Mesh package records.
  • Passed: full pre-push hook suite on the final push (branch-skew, rust-tests, desktop-tauri-checks, file-size-check) — no hooks bypassed.
  • Not run: live Mesh inference/admission smoke or installed-app UI exercise. CI lifecycle smoke coverage applies.

Originating Buzz conversation: buzz://message?channel=dffbc117-845a-4c02-bc3f-eaeeefc4deaa&id=670f9c262e1ec0a4df5600b3173a0c5de2abe17e08ba9ccfdd8eff109fadf1a8

Thinker
chore(mesh): upgrade MeshLLM to 0.76.0
5595d99 
Pin the desktop and relay smoke dependencies to the stable release and regenerate both lockfiles. Match its Ed25519 and SQLite dependencies, retaining unsigned SQL conversions in non-mesh desktop builds.

Use the merged SQLx SQLite compatibility fix until a crates.io release includes transact-rs/sqlx#4402. The PostgreSQL driver remains on crates.io SQLx 0.9.0.

Signed-off-by: Thinker <75d8a808fa21bb8d1812e080cf471db601c6e8e6a62dcd516d37531e83a7bb77@meshllm.communities.buzz.xyz>
@micspiral
micspiral requested a review from a team as a code owner September 10, 2026 14:27
@github-actions

github-actions Bot commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown

🔐 Codex Security Review

Status: review required for the current range.

The current range is 7c789dee09d198469bded1cb5be902eaf5562ad9...ae4adba15c69026264f0d0e18272d3b1ba0e547c.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review ae4adba15c69026264f0d0e18272d3b1ba0e547c to authorize a new review.
Any previous review applies only to its recorded range.

@micspiral
micspiral marked this pull request as draft September 11, 2026 01:21
@michaelneale
fix(mesh): restore Linux keyring crypto and unblock relay CI budget
23ab7ec 
Two follow-ups to the MeshLLM 0.76.0 upgrade, both consequences of the
same thing: Buzz was relying on Cargo feature/dependency unification with
mesh-llm rather than declaring what it needs.

1. Linux Secret Service sessions dropped to plaintext.

   Until 0.76, mesh-llm enabled `crypto-rust` on the *same* keyring 3 the
   desktop uses, so Buzz inherited it through feature unification. 0.76
   moves mesh-llm to keyring 4, and desktop's own declaration only asked
   for `sync-secret-service,vendored`.

   `keyring-3.6.3/src/secret_service.rs:140-143,333-336` selects
   `EncryptionType::Dh` only under a crypto feature and `Plain` otherwise,
   so Linux mesh-enabled builds lost Diffie-Hellman transit encryption for
   nsec reads/writes over the D-Bus session bus. Visible in the lockfile:
   `dbus-secret-service 4.1.0` lost aes/block-padding/cbc/hkdf/sha2/num/
   fastrand/once_cell.

   Fixed by requesting `crypto-rust` explicitly. It restores exactly the
   packages the pre-upgrade lock already had, so it costs nothing.

2. Desktop E2E Relay exceeded its 30 minute timeout.

   The mesh-llm SDK and native runtime were dev-dependencies of
   `buzz-relay`. A dev-dependency feeds *every* target of its package, so
   `cargo nextest archive -p buzz-relay` had to compile the whole
   mesh-llm + skippy + rmcp + hf-xet tree before a single relay unit test
   could build — and the mesh pin bump invalidated that cache wholesale.

   The six harnesses that need it are examples that drive the relay as an
   external process; none reference `buzz_relay::`. Moved them to a new
   examples-only crate `buzz-mesh-smoke` so the cost lands only on the
   Mesh Lifecycle workflow that actually runs them.

   buzz-relay's dev graph: 692 -> 453 packages, with zero mesh-llm,
   skippy, rmcp, hf-xet or keyring entries remaining.

Verified: `cargo clippy -p buzz-mesh-smoke -p buzz-relay --all-targets
-- -D warnings` clean; all six harnesses compile in the new crate;
`cargo test -p buzz-relay --lib` 1034 passed, with 6 pre-existing
`Sqlx(PoolTimedOut)` media tests that require Postgres (not run locally).
Not verified locally: Linux keyring runtime behaviour and the Mesh
Lifecycle smoke, both of which need CI.

Co-authored-by: Michael Neale <michael.neale@gmail.com>
Signed-off-by: Michael Neale <michael.neale@gmail.com>
@michaelneale
Merge origin/main into Mesh release update
67615aa 
Co-authored-by: Michael Neale <michael.neale@gmail.com>
Signed-off-by: Michael Neale <michael.neale@gmail.com>
@michaelneale
chore(mesh): update MeshLLM to v0.76.1
5bccac3 
Preserve the explicit Linux keyring crypto feature and dedicated smoke crate. Refresh only Mesh source packages in both lockfiles; all non-Mesh package records remain unchanged from the main merge.

Co-authored-by: Michael Neale <michael.neale@gmail.com>
Signed-off-by: Michael Neale <michael.neale@gmail.com>
@micspiral micspiral changed the title chore(mesh): upgrade MeshLLM to 0.76.0 chore(mesh): upgrade MeshLLM to 0.76.1 Sep 14, 2026
@michaelneale
michaelneale marked this pull request as ready for review September 14, 2026 03:14
@micspiral
micspiral marked this pull request as draft September 15, 2026 03:30
michaelneale and others added 2 commits September 15, 2026 16:08
@michaelneale Galadriel
chore(mesh): update MeshLLM to v0.76.2
ed1b4de 
Bump all eight Mesh git dependencies from v0.76.1 (ff18c0b5a) to
v0.76.2 (a0c1e66b0) in desktop/src-tauri and buzz-mesh-smoke. Both
lockfiles resolve all 47 Mesh packages to the v0.76.2 tag; all
non-Mesh lock records are unchanged.

Co-authored-by: Galadriel <b81c841ed20a8e17caf4e6fac2f6f3bc61d304c84b8394720f6d00f37538c47e@meshllm.communities.buzz.xyz>
Signed-off-by: Michael Neale <michael.neale@gmail.com>
@michaelneale
Merge remote-tracking branch 'origin/main' into micspiral/mesh-0.76.0
ae4adba 
* origin/main:
  Fix Apple Silicon iOS simulator builds (#7646)

Signed-off-by: Michael Neale <michael.neale@gmail.com>
@michaelneale michaelneale changed the title chore(mesh): upgrade MeshLLM to 0.76.1 chore(mesh): upgrade MeshLLM to 0.76.2 Sep 15, 2026
@michaelneale
michaelneale marked this pull request as ready for review September 15, 2026 07:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@micspiral @bp2m6v4sp5-dev @michaelneale