ci(security): allow retired relay pool advisory - #5404

## Summary

- temporarily allow the informational `RUSTSEC-2026-0243` advisory for
the retired `nostr-relay-pool` crate
- document the exact MeshLLM → `nostr-sdk 0.44.1` transitive path and
removal condition
- keep every other advisory and the global dependency policy enforced

## Why an exception

RustSec provides no patched `nostr-relay-pool` release because the
standalone crate was absorbed into `nostr-sdk >= 0.45`. Buzz inherits it
through pinned MeshLLM v0.74. A direct test bump to `nostr-sdk 0.45.1`
removed the retired crate but produced 13 MeshLLM API compilation
errors, so the durable fix requires an upstream source migration rather
than a lockfile update.

This narrow exception restores the required Security check while that
migration is completed. It must be removed once MeshLLM adopts
`nostr-sdk >= 0.45`.

## Validation

- `bin/cargo-deny --locked check --config deny.toml advisories`
- `bin/cargo-deny --locked check`
- `git diff --check origin/main...HEAD`
- mandatory pre-push Rust and desktop/Tauri checks

## Scope

One four-line `deny.toml` addition. No Rust source, lockfile, runtime,
or release behavior changes.

Signed-off-by: Wes <wesbillman@users.noreply.github.com>
Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>
(cherry picked from commit d2ebaa9)
Signed-off-by: adrienlacombe <6303520+adrienlacombe@users.noreply.github.com>

…ckend

* origin/main:
  chore(deps): update react monorepo (#4441)
  ci(security): allow retired relay pool advisory (#5404)
  chore(deps): update dependency @tanstack/react-virtual to v3.14.9 (#4439)
  chore(deps): update all non-major dependencies (#3049)
  chore(deps): update rust crate anyhow to v1.0.104 (#4447)
  chore(deps): update rust crate arc-swap to v1.9.2 (#4448)
  chore(deps): update rust crate async-trait to v0.1.91 (#4458)
  chore(deps): update rust crate diffy to v0.5.1 (#4466)
  chore(deps): update rust crate async-compression to v0.4.43 (#4456)
  chore(deps): update rust crate clap to v4.6.6 (#4465)
  fix(desktop): preserve Welcome banner dismissal (#5406)

Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>

## Summary

- temporarily allow the informational `RUSTSEC-2026-0243` advisory for
the retired `nostr-relay-pool` crate
- document the exact MeshLLM → `nostr-sdk 0.44.1` transitive path and
removal condition
- keep every other advisory and the global dependency policy enforced

## Why an exception

RustSec provides no patched `nostr-relay-pool` release because the
standalone crate was absorbed into `nostr-sdk >= 0.45`. Buzz inherits it
through pinned MeshLLM v0.74. A direct test bump to `nostr-sdk 0.45.1`
removed the retired crate but produced 13 MeshLLM API compilation
errors, so the durable fix requires an upstream source migration rather
than a lockfile update.

This narrow exception restores the required Security check while that
migration is completed. It must be removed once MeshLLM adopts
`nostr-sdk >= 0.45`.

## Validation

- `bin/cargo-deny --locked check --config deny.toml advisories`
- `bin/cargo-deny --locked check`
- `git diff --check origin/main...HEAD`
- mandatory pre-push Rust and desktop/Tauri checks

## Scope

One four-line `deny.toml` addition. No Rust source, lockfile, runtime,
or release behavior changes.

Signed-off-by: Wes <wesbillman@users.noreply.github.com>
Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>

…n retired

#5404 allowed RUSTSEC-2026-0243 with the removal condition written into the
comment: "Remove after mesh-llm migrates to nostr-sdk >= 0.45, which absorbed
the standalone relay pool." MeshLLM v0.75.1 does exactly that, so
nostr-relay-pool is no longer in either lockfile and the advisory has nothing
to fire on.

That PR measured 13 MeshLLM API compilation errors from bumping nostr-sdk to
0.45 against v0.74; upstream did the migration in v0.75, which is why this
needs no source change here.

Verified with the same commands #5404 used:
bin/cargo-deny --locked check --config deny.toml advisories, and
bin/cargo-deny --locked check -- advisories ok, bans ok, licenses ok, sources ok.

Leaving a satisfied exception in place would suppress a real future advisory
for this crate, so it goes with the bump that retired it rather than waiting for
someone to notice.

Signed-off-by: Michael Neale <michael.neale@gmail.com>

## Summary

- temporarily allow the informational `RUSTSEC-2026-0243` advisory for
the retired `nostr-relay-pool` crate
- document the exact MeshLLM → `nostr-sdk 0.44.1` transitive path and
removal condition
- keep every other advisory and the global dependency policy enforced

## Why an exception

RustSec provides no patched `nostr-relay-pool` release because the
standalone crate was absorbed into `nostr-sdk >= 0.45`. Buzz inherits it
through pinned MeshLLM v0.74. A direct test bump to `nostr-sdk 0.45.1`
removed the retired crate but produced 13 MeshLLM API compilation
errors, so the durable fix requires an upstream source migration rather
than a lockfile update.

This narrow exception restores the required Security check while that
migration is completed. It must be removed once MeshLLM adopts
`nostr-sdk >= 0.45`.

## Validation

- `bin/cargo-deny --locked check --config deny.toml advisories`
- `bin/cargo-deny --locked check`
- `git diff --check origin/main...HEAD`
- mandatory pre-push Rust and desktop/Tauri checks

## Scope

One four-line `deny.toml` addition. No Rust source, lockfile, runtime,
or release behavior changes.

Signed-off-by: Wes <wesbillman@users.noreply.github.com>
Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>
Signed-off-by: Dekan Brown <dekanbro@gmail.com>

…gaps

* origin/main: (35 commits)
  feat(desktop): time-based sweep for stale localStorage caches (#5453)
  ci(release): gate OSS desktop auto-update promotion (#5398)
  fix(release): pin desktop PR operations to block/buzz (#5212)
  fix(search): surface exact short profile names (#5480)
  Reduce repeated ACP session context (#5423)
  feat(desktop): NIP-AM agent-usage backend — P2 emission/transport/archive + P4a aggregation/D6 (#4000)
  fix(desktop): resolve overlapping member mentions (#5225)
  chore(deps): update react monorepo (#4441)
  ci(security): allow retired relay pool advisory (#5404)
  chore(deps): update dependency @tanstack/react-virtual to v3.14.9 (#4439)
  chore(deps): update all non-major dependencies (#3049)
  chore(deps): update rust crate anyhow to v1.0.104 (#4447)
  chore(deps): update rust crate arc-swap to v1.9.2 (#4448)
  chore(deps): update rust crate async-trait to v0.1.91 (#4458)
  chore(deps): update rust crate diffy to v0.5.1 (#4466)
  chore(deps): update rust crate async-compression to v0.4.43 (#4456)
  chore(deps): update rust crate clap to v4.6.6 (#4465)
  fix(desktop): preserve Welcome banner dismissal (#5406)
  fix(agent): retry LLM completion on malformed 2xx JSON body (#5351)
  fix(desktop): welcome banner overlap and missing dismiss control (#5330)
  ...

# Conflicts:
#	crates/buzz-acp/src/config.rs

…gaps

* origin/main: (35 commits)
  feat(desktop): time-based sweep for stale localStorage caches (#5453)
  ci(release): gate OSS desktop auto-update promotion (#5398)
  fix(release): pin desktop PR operations to block/buzz (#5212)
  fix(search): surface exact short profile names (#5480)
  Reduce repeated ACP session context (#5423)
  feat(desktop): NIP-AM agent-usage backend — P2 emission/transport/archive + P4a aggregation/D6 (#4000)
  fix(desktop): resolve overlapping member mentions (#5225)
  chore(deps): update react monorepo (#4441)
  ci(security): allow retired relay pool advisory (#5404)
  chore(deps): update dependency @tanstack/react-virtual to v3.14.9 (#4439)
  chore(deps): update all non-major dependencies (#3049)
  chore(deps): update rust crate anyhow to v1.0.104 (#4447)
  chore(deps): update rust crate arc-swap to v1.9.2 (#4448)
  chore(deps): update rust crate async-trait to v0.1.91 (#4458)
  chore(deps): update rust crate diffy to v0.5.1 (#4466)
  chore(deps): update rust crate async-compression to v0.4.43 (#4456)
  chore(deps): update rust crate clap to v4.6.6 (#4465)
  fix(desktop): preserve Welcome banner dismissal (#5406)
  fix(agent): retry LLM completion on malformed 2xx JSON body (#5351)
  fix(desktop): welcome banner overlap and missing dismiss control (#5330)
  ...

# Conflicts:
#	crates/buzz-acp/src/config.rs

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>