fix(deps): bump zip to 9 for RUSTSEC-2026-0367/0368/0369 - #2471

🤖 Excludes the test-only `buzz-mesh-smoke` crate from the `cargo-deny`
graph via `[graph] exclude` in `deny.toml`.

`buzz-mesh-smoke` holds hardware smoke-test examples; nothing from it
ships. It is the only root-workspace crate that depends on `mesh-llm`,
which brings in `zip` 8.6 (RUSTSEC-2026-0367/-0368/-0369), the `zbus` 5
unmaintained notices (RUSTSEC-2026-0370/-0371/-0372), and `negentropy`
via `mesh-llm-client` → `nostr-sdk` (RUSTSEC-2026-0365). None has a
usable upstream fix for the pinned `mesh-llm` v0.76.2. The `zip` bump
has merged upstream in
[mesh-llm#2471](Mesh-LLM/mesh-llm#2471), but no
`mesh-llm` release contains it yet (latest is v0.78.1).

CI's Security job runs `cargo-deny check` from the repo root, which
reads this `deny.toml`, so the exclusion applies there. These advisories
remain fatal for any shipped crate that pulls in the same dependencies.
No existing advisory ignores were changed.

Signed-off-by: Will Pfleger <[email protected]>
Co-authored-by: Hayt <211b96e6a2b7f45fd4047988976c7bbbeeda0c15f3ae7b32eec20834b5a55118@buzz.block.builderlab.xyz>

🤖 Bumps the desktop app's direct `zip` dependency from 8 to 9 to clear
RUSTSEC-2026-0367, RUSTSEC-2026-0368 and RUSTSEC-2026-0369 on the
managed Node.js archive extraction path.

zip 9 makes `ZipArchive::name_for_index` and `ZipFile::name` fallible.
Managed Node.js zip validation now rejects an entry whose name can't be
decoded, and the "unsafe path" error prints the raw entry name lossily.
The absolute-path, drive-prefix, traversal and `enclosed_name()` checks
are unchanged.

The lockfile update is scoped to `zip`; it pulls in newer `zstd`,
`lzma-rust2` and `ppmd-rust` that zip 9 requires.

**`zip` 8 is still in release builds.** With `--features mesh-llm`,
`mesh-llm` v0.76.2 (`mesh-llm-system`, `mesh-llm-plugin-manager`,
`mesh-llm-host-runtime`) still depends on `zip` 8.6.0. That goes away
when the `mesh-llm` pin moves to a release that includes
Mesh-LLM/mesh-llm#2471.

Signed-off-by: Will Pfleger <[email protected]>
Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>

🤖 Removes the whole-crate `[graph] exclude = ["buzz-mesh-smoke"]` from
`deny.toml`, so the root `cargo-deny` check covers `buzz-mesh-smoke` and
its `mesh-llm` dependency again. The advisories that crate brings in are
ignored one ID at a time instead, each naming its dependency path and
when to remove it:

- `RUSTSEC-2026-0367` / `0368` / `0369` — `zip` 8.6.0 extraction bugs
via `buzz-mesh-smoke` → `mesh-llm` v0.76.2. `mesh-llm` copies entries
manually and never calls `ZipArchive::extract`. Remove on the `mesh-llm`
release that ships Mesh-LLM/mesh-llm#2471.
- `RUSTSEC-2026-0370` / `0371` / `0372` — unmaintained (not vulnerable)
`zvariant`, `zbus_names`, `zvariant_derive` via `mesh-llm` → `keyring` 4
→ `secret-service` 5 → `zbus` 5. Remove when that stack leaves `zbus` 5.

Any new advisory under `mesh-llm` now fails CI instead of being silently
excluded. No workflow or lockfile changes; the old beta desktop crate in
`desktop/` is not checked.

Signed-off-by: Will Pfleger <[email protected]>
Co-authored-by: Hayt <211b96e6a2b7f45fd4047988976c7bbbeeda0c15f3ae7b32eec20834b5a55118@buzz.block.builderlab.xyz>

…endency policy (#8922)

Two RustSec advisories published after Oct 30 turned the `Security /
Dependency policy` (`cargo-deny check`) job red on every PR. This clears
both.

## Changes

- **`pulldown-cmark` 0.13.5 → 0.13.6**
([RUSTSEC-2026-0433](https://rustsec.org/advisories/RUSTSEC-2026-0433)).
Lockfile only — `crates/buzz-relay/Cargo.toml` already allows `0.13.4`+.
Not exploitable here regardless: the advisory needs
`Options::ENABLE_WIKILINKS`, and our only caller
(`crates/buzz-relay/src/api/invites.rs`) uses the default `Parser::new`.
- **Ignore
[RUSTSEC-2026-0429](https://rustsec.org/advisories/RUSTSEC-2026-0429)**
for `zip` 8.6.0 in `deny.toml`, next to the existing
RUSTSEC-2026-0367/0368/0369 entries for the same path. The only path is
the dev-only `buzz-mesh-smoke` crate → mesh-llm v0.76.2 → zip 8. The
advisory is in `ZipArchive::extract`. Both mesh-llm zip readers at
v0.76.2 (`mesh-llm-plugin-manager/src/archive.rs`,
`mesh-llm-system/src/autoupdate/release_fetch.rs`) iterate `by_index`
and `io::copy` each entry by hand and never call `extract`. We can't
bump past it yet:
[Mesh-LLM/mesh-llm#2471](Mesh-LLM/mesh-llm#2471)
moved mesh-llm to zip 9, but the latest release (v0.78.1) still locks
zip 8.6.0. The existing comment already says to remove these ignores on
the mesh-llm bump that ships it.

## Testing

On a Linux workstation at the PR head: `cargo-deny check` passes, `cargo
check --locked -p buzz-relay` builds, and the `buzz-relay` invite tests
(the `pulldown-cmark` caller) pass.

## Simpler?

No new concepts: one lockfile bump and one ignore entry that joins an
existing, already-documented group with the same removal trigger.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Signed-off-by: Luke Tornquist <[email protected]>
Co-authored-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>
Co-authored-by: Claude Opus 5.5 <[email protected]>

…endency policy (block#8922)

Two RustSec advisories published after Oct 30 turned the `Security /
Dependency policy` (`cargo-deny check`) job red on every PR. This clears
both.

## Changes

- **`pulldown-cmark` 0.13.5 → 0.13.6**
([RUSTSEC-2026-0433](https://rustsec.org/advisories/RUSTSEC-2026-0433)).
Lockfile only — `crates/buzz-relay/Cargo.toml` already allows `0.13.4`+.
Not exploitable here regardless: the advisory needs
`Options::ENABLE_WIKILINKS`, and our only caller
(`crates/buzz-relay/src/api/invites.rs`) uses the default `Parser::new`.
- **Ignore
[RUSTSEC-2026-0429](https://rustsec.org/advisories/RUSTSEC-2026-0429)**
for `zip` 8.6.0 in `deny.toml`, next to the existing
RUSTSEC-2026-0367/0368/0369 entries for the same path. The only path is
the dev-only `buzz-mesh-smoke` crate → mesh-llm v0.76.2 → zip 8. The
advisory is in `ZipArchive::extract`. Both mesh-llm zip readers at
v0.76.2 (`mesh-llm-plugin-manager/src/archive.rs`,
`mesh-llm-system/src/autoupdate/release_fetch.rs`) iterate `by_index`
and `io::copy` each entry by hand and never call `extract`. We can't
bump past it yet:
[Mesh-LLM/mesh-llm#2471](Mesh-LLM/mesh-llm#2471)
moved mesh-llm to zip 9, but the latest release (v0.78.1) still locks
zip 8.6.0. The existing comment already says to remove these ignores on
the mesh-llm bump that ships it.

## Testing

On a Linux workstation at the PR head: `cargo-deny check` passes, `cargo
check --locked -p buzz-relay` builds, and the `buzz-relay` invite tests
(the `pulldown-cmark` caller) pass.

## Simpler?

No new concepts: one lockfile bump and one ignore entry that joins an
existing, already-documented group with the same removal trigger.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Signed-off-by: Luke Tornquist <[email protected]>
Co-authored-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>
Co-authored-by: Claude Opus 5.5 <[email protected]>
(cherry picked from commit c9b8f11)
Signed-off-by: SanHsien <[email protected]>