fix(deps): clear qs Dependabot alerts + drop stale advisory waivers (#330)

* fix(deps): bump qs to 6.16.0 in hyper-explorer example

Clears two GitHub Dependabot alerts against the transitive `qs`
dependency in the hyper-explorer example app:

- GHSA-4mjr-xmp4-gh2g (medium): DoS via attacker-controlled isBuffer
- GHSA-x5fp-wj9c-mxmx (medium): array-limit bypass via bracket-key
  comma parsing

`express`/`body-parser` cap `qs` at `~6.15.1`, so a plain update can't
reach the fix. 6.16.0 is a semver-minor (API-compatible) over 6.15, so
an `overrides` entry forces it without touching the parents. `npm audit`
in the example now reports 0 vulnerabilities.

* chore(security): drop stale paste and thrift advisory waivers

Both crates have dropped out of the dependency tree (the parquet 59
migration removed them), so their waivers are dead config:

- RUSTSEC-2024-0436 (`paste`, unmaintained): no longer in Cargo.lock —
  cargo-deny was already emitting an `advisory-not-detected` warning for
  this entry. Removing it silences that warning.
- The forward-looking `thrift` note (CVE-2026-43868): `thrift` is no
  longer pulled transitively, so the note is moot.

The `rsa` (RUSTSEC-2023-0071) and `ttf-parser` (RUSTSEC-2026-0192)
waivers stay — both crates are still present and neither has a fix.
`cargo deny check advisories` and `cargo audit` both pass.

Author: StefanSteiner

.cargo/audit.toml

@@ -5,9 +5,6 @@
 
 [advisories]
 ignore = [
-    # `paste` is unmaintained; macro-only crate pulled transitively by `parquet`
-    # (hyperapi-mcp). No runtime code path, no runtime risk.
-    "RUSTSEC-2024-0436",
     # `rsa` Marvin Attack — no constant-time fix yet. Used only for outbound
     # JWT signing in `hyperapi-salesforce`, where timing sidechannels are not
     # observable to a remote attacker. Threat model does not apply.
@@ -17,11 +14,3 @@ ignore = [
     # runtime risk. Tracking plotters-rs/plotters#736. Mirror of deny.toml.
     "RUSTSEC-2026-0192",
 ]
-
-# Forward-looking note (no waiver yet — RustSec hasn't issued an ID):
-# CVE-2026-43868 / GHSA-2f9f-gq7v-9h6m affects the `thrift` Rust crate
-# (≤ 0.22.0). Latest published is 0.17.0; Apache Thrift hasn't released
-# a fixed Rust crate (the "0.23.0 fix" is in C++/Java/Python only). We
-# pull thrift transitively via `parquet` in hyperdb-mcp. When RustSec
-# assigns a `RUSTSEC-2026-NNNN` ID, add it to the ignore list above
-# with the matching entry in deny.toml.

deny.toml

@@ -53,9 +53,6 @@ yanked = "warn"
 # Specific advisories we have reviewed and chosen to waive. Keep this list
 # short — each entry needs a comment explaining the mitigation.
 ignore = [
-    # `paste` is unmaintained, pulled transitively by `parquet` (hyperapi-mcp).
-    # Macro-only crate — no runtime risk. Drops out when parquet migrates.
-    { id = "RUSTSEC-2024-0436", reason = "paste is macro-only, no runtime risk; pulled by parquet only" },
     # `rsa` Marvin Attack: no patch available. The `rsa` crate is used by
     # `jsonwebtoken` inside `hyperapi-salesforce` for signing client JWTs for
     # Salesforce OAuth — this is *outbound* signing where timing sidechannels
@@ -73,17 +70,6 @@ ignore = [
     { id = "RUSTSEC-2026-0192", reason = "ttf-parser unmaintained, no patch exists; transitive via plotters chart rendering, no direct use, no runtime risk" },
 ]
 
-# Forward-looking note (no waiver yet — RustSec hasn't issued an ID):
-# CVE-2026-43868 / GHSA-2f9f-gq7v-9h6m affects the `thrift` Rust crate
-# (≤ 0.22.0). The latest published version on crates.io is 0.17.0 — Apache
-# Thrift has not released a fixed Rust crate (the project's "0.23.0 fix"
-# is in C++/Java/Python only). We pull `thrift` transitively via `parquet`
-# in hyperdb-mcp (parquet metadata parsing only — used against operator-
-# supplied local files via `load_file`/`query_file`/`export`). When
-# RustSec assigns a `RUSTSEC-2026-NNNN` ID, add it to the ignore list
-# above with rationale: "thrift transitively via parquet; no fix
-# available on crates.io; operator-controlled inputs only."
-
 # -------------------------------------------------------------------------
 # Banned / duplicate crates
 # -------------------------------------------------------------------------

hyperdb-api-node/examples/hyper-explorer/package-lock.json

@@ -16,6 +16,9 @@
     "hyperdb-api-node": "file:../../",
     "sql-formatter": "^15.7.2"
   },
+  "overrides": {
+    "qs": "^6.16.0"
+  },
   "devDependencies": {
     "@types/cors": "^2.8.17",
     "@types/express": "^4.17.21",