[matt2e]

Why

This PR exists because of the Renovate PR #873, "fix(deps): update all non-major dependencies". That PR bumps rusqlite from 0.40 to 0.41 in src-tauri/Cargo.toml, and the bump cannot resolve:

• The pinned mesh-llm revision (5d19ca6, set in src/bundled/mesh-compute/compute/Cargo.toml) includes mesh-llm-log-store, which requires rusqlite = "0.40".
• rusqlite 0.40 depends on libsqlite3-sys 0.38 and rusqlite 0.41 depends on libsqlite3-sys 0.39. Both link the native sqlite3 library, and Cargo allows only one such crate in a dependency graph.
• mesh-llm's main branch still requires rusqlite 0.40 as of 13 November 2026, so there is no newer revision to move the pin to.

Renovate could not regenerate Cargo.lock, so #873 carries the 0.41 manifest with the 0.40.2 lockfile and a failing renovate/artifacts status. Its Rust and tool integration job stops at dependency resolution:

error: failed to select a version for `libsqlite3-sys`.
package `libsqlite3-sys` links to the native library `sqlite3`, but it conflicts with a previous package which links to `sqlite3` as well:
package `libsqlite3-sys v0.39.0`
    ... which satisfies dependency `rusqlite = "^0.41"` of package `Buzz v0.0.0`

Renovate groups this bump as "minor", but Cargo treats a 0.x minor bump as breaking. Without a hold, Renovate will keep proposing it. It already lists 0.42.0 as pending.

main already records the constraint in two places: the comment above the rusqlite line in src-tauri/Cargo.toml, and the RUSTSEC-2026-0459 entry in deny.toml. Renovate reads neither.

What

Add one packageRules entry to renovate.json that keeps the cargo rusqlite dependency below 0.41. It sits beside the existing gtk and sha2 holds and uses the same form.

Nothing else changes. src-tauri/Cargo.toml already declares rusqlite 0.40 on main and Cargo.lock resolves 0.40.2, so there is no manifest or lockfile diff.

Why a separate PR

The hold cannot live on the Renovate branch, for two reasons:

• Renovate reads its config from the default branch. Its docs say it reads the config file "from the default branch only" unless useBaseBranchConfig is set, and this repository does not set it. A renovate.json change on renovate/all-minor-patch has no effect until it reaches main.
• Renovate owns and regenerates that branch. fix(deps): update all non-major dependencies #873 is a single renovate[bot] commit that Renovate has force-pushed more than 1,300 times. Its docs say that pushing another author's commit to a Renovate branch makes Renovate stop updating it, and that a requested rebase regenerates the commit and discards the edits. A hold committed there would either freeze the grouped update or be thrown away.

What happens to #873

After this merges, #873 will be behind main. Renovate rebases that PR whenever it is behind its base, and it rebuilds the commit from the current config. The expected result is that the rusqlite row drops out of #873 and the manifest returns to 0.40. If it does not happen on Renovate's next run, ticking the rebase/retry checkbox in the #873 description requests it.

This PR does not make #873 green. #873 has a second, independent failure that this PR does not touch: it also updates Biome from 2.5.14 to 2.6.6, and all six JavaScript shards fail in the lint step because Biome 2.6 reports errors on the existing code. That needs its own change. Other updates in the group may also need attention once Cargo can resolve again.

When to remove the hold

Remove the rule when mesh-llm moves to rusqlite 0.41 or later and Buzz's mesh-llm pin moves to that revision. That is the same condition deny.toml gives for removing the RUSTSEC-2026-0459 exception. The rusqlite bump, the pin bump, the comment in src-tauri/Cargo.toml and the deny.toml entry should then change together.

Risk

Low. The rule only limits what Renovate proposes and keeps the version main already uses. The app, the build and CI do not read renovate.json. The cost is that rusqlite stays on 0.40 and the advisory exception already accepted in deny.toml stays in place until mesh-llm moves.

Validation

• renovate-config-validator --strict from Renovate 44.227.4, run in the repository root, reports Config validated successfully against 1 file(s).
• As a control, the same validator rejects a copy of the file with the new rule's matchPackageNames key misspelled.
• The diff against main is renovate.json only, six added lines.

Not verified: how Renovate itself applies the rule. That can only be observed on its first run after this merges. No app behavior changes, so there is nothing to exercise in the app.

Refs #873

🤖 Generated with Claude Code

[kazemek21]

I reviewed the PR and went through the Nexus review-tracker notes. I didn't see any P2-or-higher issues in this change.

Posted by Codex (gpt-6.1-sol) on behalf of kylez

[wesbillman]

🤖 Star Lord’s automated source review via Wes’s account.

No actionable findings at head 4c8c9a0910e295fccc7e0d4403e5297204868635 against target/merge-base 7f03764beb8eb0ddcb4ff9ec0b8bda3e07699716.

The six-line rule targets Cargo’s rusqlite dependency and excludes 0.41+ while preserving 0.40 patch updates. It agrees with Buzz’s direct 0.40 requirement and the pinned mesh-llm log store; the manifests, lockfile and existing advisory exception are unchanged. The documented removal condition correctly couples lifting the hold to moving Buzz’s mesh-llm pin. The PR description and public diff were also inspected.

Source-only review: no validator, dependency resolution, builds, tests or app were run. The author’s validator result was not independently reproduced, and Renovate’s hosted application of this rule remains unobserved. This review does not establish that #873 will pass its other checks.