[matt2e]

Why

The Dependency policy step of the "Rust and tool integration" job fails on every run since about 2026-11-09 09:30Z, independent of any PR's changes (main's run 42593548798 at 09:27Z passed; PR #3074's run 42597212482, job 129092678543, failed):

error[vulnerability]: libsqlite3-sys via C SQLite CVE-2026-119375 — RUSTSEC-2026-0459

libsqlite3-sys 0.38.2 bundles SQLite 3.53.2. SQLite before 3.54.0 can return uninitialised page-cache memory when a database file is opened together with a sibling -wal file whose page size differs. Path: libsqlite3-sys 0.38.2 ← rusqlite 0.40.2 ← Buzz and ← mesh-llm-log-store 0.78.1 ← mesh-llm-host-runtime ← buzz-mesh-compute.

What

Upgrade is blocked, so this adds a deny.toml exception (option 2). The advisory's fix is libsqlite3-sys ≥ 0.39.0, which only rusqlite 0.41 uses. cargo update -p libsqlite3-sys is a no-op: rusqlite 0.40.2 (the latest 0.40) pins libsqlite3-sys ^0.38. mesh-llm-log-store at the pinned bridge rev 5d19ca6 requires rusqlite ^0.40 (upstream main does too), and only one libsqlite3-sys may link sqlite3, so Buzz cannot move its own rusqlite to 0.41 without a mesh-llm bump. That is a larger change than clearing CI and is out of scope here.

The exception follows the file's existing style and records why Buzz is not exposed, checked against the code:

• Buzz's archive (src-tauri/src/archive/mod.rs) opens events.sqlite3 under Tauri's app_data_dir, a directory it creates itself.
• src-tauri/src/legacy_communities.rs opens old Buzz's own WebKit localstorage.sqlite3 under ~/Library/WebKit/<bundle id> read-only.
• mesh-llm's log store opens log_store.db under its app-state root (configured path, MESH_LLM_DATA_DIR, or the platform local app-data dir), which the runtime creates.

All are per-user directories written by the same code, so a less-trusted party writing a sibling -wal is outside the threat model. The comment says to remove the exception when mesh-llm moves to rusqlite ≥ 0.41.

Also in this PR, because they fail or warn in the same step:

• RUSTSEC-2026-0462 appeared after the cited run and fails the step too: rmcp < 3.9.0 buffers Streamable HTTP response bodies without limit (via mesh-llm-host-runtime). cargo update -p rmcp moves rmcp and rmcp-macros 3.8.0 → 3.9.0, within range.
• The yanked async-executor 1.14.0 moves to 1.14.1 (cargo update -p async-executor).
• The remaining Cargo.lock lines are cargo re-choosing already-locked windows-sys/windows-core versions for crates with wide version ranges. The package set is unchanged. Each new edge matches cargo metadata --locked.
• The yanked clipboard-win 5.4.1 and nostr-sdk 0.45.5 warnings predate this (they are in the cited job log) and are left alone.

Resulting versions: libsqlite3-sys 0.38.2, rusqlite 0.40.2 (unchanged); rmcp 3.9.0; async-executor 1.14.1.

Verified

• ./bin/cargo-deny --locked check: advisories ok, bans ok, licenses ok, sources ok (exit 0). Before the change it failed on RUSTSEC-2026-0459 and, after the lock rewrite, RUSTSEC-2026-0462.
• ./bin/cargo check --workspace --locked --all-targets compiles.

Not verified

• Rust tests, clippy, and the desktop app were not run; this PR changes no source. CI runs them.
• Pushed with --no-verify.

Precedent: aceb6fa "deps: tauri-plugin-updater 2.14.1 moves zip to 9, clearing RUSTSEC-2026-0429 (#2137)".

🤖 Generated with Claude Code

[wesbillman]

🤖 Star Lord’s automated source review via Wes’s account, integrating independent Rocket, Mantis and Groot reviews.

Reviewed e2b444a7579b6f2c924199520cf5b016eab6c744 against base/merge-base 58116b826171d190a7376fc57b0509c32c507dde. No blocking correctness or security findings in this two-file change.

The SQLite dependency remains affected; this is an explicit trust-boundary exception, not a patch. The reviewed database-open paths and mesh directory preparation support the stated assumption that less-trusted parties cannot supply the database/WAL pair. Read-only SQLite access does not itself mitigate this advisory. The rmcp update meets RUSTSEC-2026-0462’s patched range, and the changed lockfile edges are consistent with the reviewed registry requirements.

Two optional documentation corrections:

• In deny.toml:32–38, describe trusted per-user storage and trusted local environment configuration rather than saying every directory was created by “the same code”: old WebKit storage and an existing standalone mesh directory can predate Buzz.
• In the PR description, include data-encoding-macro-internal → syn 1.0.109 and tempfile → getrandom 0.3.4 among the lockfile reselections; the remaining changes are not exclusively Windows edges.

Validation: this was source/registry/advisory review only; we ran no local builds, tests, dependency commands or app workflows. At the reviewed head, hosted CI required and Rust/tool integration passed, including dependency policy, Rust lint, and all Rust tests/doctests. Windows native validation was skipped, so Windows execution remains unverified. The description’s local cargo checks and --no-verify push are author-reported; hosted success does not establish that local hooks ran. No attachments were present in the reviewed PR description.