chore(deps): refresh Rust + npm + GHA dependencies

[StefanSteiner]

Refresh Rust + npm + GHA dependencies

Summary

First deliberate dependency refresh since the open-source cut on 2026-05-11 (deps then were current as of that date; we've shipped two patches since under v0.1.1). Goal of this PR is to bring the lockfile and direct-dep floors back to current, plus pick up a small number of major bumps where the migration is genuinely trivial — without touching anything that would expand API surface or trigger a downstream-crate audit.

Five atomic commits, each with its own verification gate, so any individual commit can be reverted post-merge if a regression appears:

#	Commit	Scope
1	23d53da chore(deps): cargo update	Transitive refresh only — Cargo.lock only.
2	3be229e chore(deps): tighten Rust workspace dep floors	Lift [workspace.dependencies] floors to lockfile-resolved versions.
3	a6723df chore(deps): bump RustCrypto traits	Selective major — sha2 0.11, hmac 0.13, pbkdf2 0.13, md-5 0.11.
4	dde6698 chore(deps): bump npm devDeps	@napi-rs/cli ^3.6.2, tsx ^4.22.0.
5	cbdd87f chore(deps): bump GHA actions	actions/cache@v5, release-please-action@v5, action-gh-release@v3.

---

Commit 1: chore(deps): cargo update

cargo update against current Cargo.toml constraints. Touches Cargo.lock only — no crate-version policy change.

Most of the lockfile drift since 2026-05-11 lands here. Notable transitive bumps picked up by the resolver:

• arrow 58.2 → 58.3
• jsonwebtoken 10.3 → 10.4
• napi 3.8 → 3.9
• parquet 58.2 → 58.3
• rmcp 1.6 → 1.7
• tokio 1.52.1 → 1.52.3
• tonic 0.14.5 → 0.14.6

Smallest commit, biggest leverage on lockfile staleness.

---

Commit 2: chore(deps): tighten Rust workspace dep floors

Where the workspace Cargo.toml floors had drifted noticeably below what the lockfile already resolves to, lift the floor so a fresh cargo build doesn't pick up an old major-internal version on a downstream consumer.

Crate	Before	After	Reason
bytes	1.5	1.11	Floor was 7+ minor releases behind.
tempfile	3.10	3.20	Floor far below resolved.
smallvec (in hyperdb-api/Cargo.toml)	1.13	1.15	Same.
rmcp (in hyperdb-mcp/Cargo.toml)	1	1.7	Tighter floor for the MCP server SDK.
csv (in hyperdb-mcp/Cargo.toml)	1.3	1.4	Match resolved.
schemars (in hyperdb-mcp/Cargo.toml)	1.0	1.2	Match resolved.

No code changes — these are all within-major bumps and the API surface is unchanged.

---

Commit 3: chore(deps): bump RustCrypto traits — sha2 0.11, hmac 0.13, pbkdf2 0.13, md-5 0.11

The only major-version bump in this PR. The RustCrypto traits ecosystem moves in lockstep, so sha2/hmac/pbkdf2/md-5 all get bumped together. They're used in two places:

• hyperdb-api-core::client::auth for SCRAM-SHA-256 and MD5 password authentication.
• hyperdb-bootstrap::download for SHA-256 verification of the downloaded hyperd archive.

Crate	Before	After
sha2	0.10	0.11
hmac	0.12	0.13
pbkdf2	0.12	0.13
md-5	0.10	0.11

Two trivial source adjustments needed

The plan's pre-commit checklist required: "if 0.11/0.13 don't compile cleanly, back out and document the holdback." Both compiled cleanly after these two adapter changes — no API ergonomics fight.

1. hmac 0.13 no longer re-exports KeyInit::new_from_slice through the Mac trait.

hyperdb-api-core/src/client/auth.rs now imports KeyInit explicitly:

- use hmac::{Hmac, Mac};
+ use hmac::{Hmac, KeyInit, Mac};

The compiler suggested this fix automatically.

2. sha2 0.11's finalize() returns Array<u8, _> (replacing GenericArray<u8, _>), which doesn't implement LowerHex.

hyperdb-bootstrap/src/download.rs:hash_file now hex-encodes the digest by iterating bytes itself, mirroring the pattern already used in hyperdb-api-core::client::auth::hex_encode:

-    Ok(format!("{:x}", hasher.finalize()))
+    // sha2 0.11 returns `Array<u8, _>` from `finalize()`, which (unlike
+    // the previous `GenericArray`) does not implement `LowerHex`. Iterate
+    // over the byte slice and lower-hex each byte ourselves.
+    let digest = hasher.finalize();
+    Ok(digest.iter().map(|b| format!("{b:02x}")).collect())

The corresponding #[expect(clippy::format_collect, …)] annotation on hash_file matches the one already on hex_encode — clippy::format_collect would otherwise demand a fold!-based rewrite that obscures intent.

Why bump these and nothing else major

Each remaining major-version-pending dep (arrow 58→59, tonic 0.14→0.15, rmcp 1→2, napi 3→4) touches API surface that downstream consumers see, would require its own audit, and is best kept out of a periodic refresh PR. The RustCrypto traits, by contrast, are entirely internal to the workspace and the migration was confined to the two adapter changes above.

---

Commit 4: chore(deps): bump npm devDeps

hyperdb-api-node/package.json devDependencies refreshed to current within-major:

Package	Before	After
@napi-rs/cli	^3	^3.6.2
tsx	^4.21.0	^4.22.0
apache-arrow	^21.1.0	(unchanged — already latest 21.x)

peerDependencies."apache-arrow": ">=14.0.0" floor stays broad on purpose — keeping that floor wide lets consumers paired with older Arrow builds continue to install the bindings.

package-lock.json regenerated via npm install. The release napi build (npm run build) and full smoke test suite (npm test, 19 cases through __test__/smoke.mjs) both pass locally.

---

Commit 5: chore(deps): bump GHA actions

Three GitHub Actions had new majors with verified-clean migration paths. The only breaking change in each is the bump from the Node 20 to Node 24 Actions runtime — a runner-side requirement, not a config change. All three GitHub-hosted runner images we use (ubuntu-latest / macos-14 / windows-latest) already ship Actions runner ≥ 2.327.1, the floor required for Node 24.

Action	Before	After	Sites
actions/cache	@v4	@v5	ci.yml (hyperd binary cache), release.yml (hyperd binary cache)
googleapis/release-please-action	@v4	@v5	release-please.yml
softprops/action-gh-release	@v2	@v3	release.yml (GitHub Release publish)

What I checked in each release's notes

• actions/cache@v5: only breaking change is Node 20 → Node 24 runtime. Otherwise drop-in.
• release-please-action@v5: only breaking change is Node 20 → Node 24 runtime. The release-please config schema is unchanged — release-please-config.json and .release-please-manifest.json need no edits. (This was the most likely failure mode going in; verified directly from the v5 release notes before bumping.)
• action-gh-release@v3: only breaking change is Node 20 → Node 24 runtime. Existing tag_name / prerelease / generate_release_notes inputs unchanged.

Deliberately NOT bumped

• actions-rust-lang/setup-rust-toolchain@v1 — already pulls latest 1.x via the floating major tag (currently v1.16.1).
• actions/checkout@v4, actions/upload-artifact@v4, actions/download-artifact@v4, actions/setup-node@v4 — same: floating-major tags, already current within-major. No new majors out yet.

---

Existing waivers — preserved as-is

These have full rationale documented in deny.toml, .cargo/audit.toml, and docs/SECURITY.md. None of them were touched by this PR:

Advisory	Crate	Status
RUSTSEC-2024-0436	paste	Transitive via parquet, macro-only — no replacement available.
RUSTSEC-2025-0134	rustls-pemfile	Unmaintained; post-1.0 migration tracked separately.
RUSTSEC-2023-0071	rsa	Marvin Attack — applies to RSA decryption, our use is outbound JWT signing only.
GHSA-2f9f-gq7v-9h6m / CVE-2026-43868	thrift	Forward-looking note in deny.toml for when RustSec ingests this as RUSTSEC-2026-NNNN. See PR #4.

---

Out of scope

Each of these would benefit from a dedicated PR with its own audit and is intentionally deferred:

• hyperd-version.toml pin (0.0.25080 from 2026-05-11) — separate decision tied to whether we want to ride latest hyperd or stay on a tested baseline.
• rust-toolchain.toml — staying on stable; toolchain bumps come automatically with each stable release on the runner image.
• Major bumps that touch public API surface:
  • arrow 58 → 59 (when released).
  • tonic 0.14 → 0.15+.
  • rmcp 1 → 2.
  • napi 3 → 4.

Verification

End-to-end gate run after each commit (so a regression is bisectable to a specific commit), and again on the integrated branch:

• cargo fmt --all --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• HYPERD_PATH="$PWD/.hyperd/current" cargo test --workspace --exclude hyperdb-api-node --exclude hyperdb-bootstrap (matches ci.yml's test job scope)
• cargo test -p hyperdb-bootstrap
• cargo deny check
• cargo audit --deny warnings
• cd hyperdb-api-node && npm install && npm run build && npm test

Test plan

• Full CI matrix (ubuntu-latest / macos-14 / windows-latest) green on this PR.
• clippy job remains clean across the workspace under -D warnings.
• cargo deny check and cargo audit --deny warnings continue to pass — the known-waiver list and [advisories].ignore are unchanged by this PR.
• npm-build-publish.yml still has access to a working napi build (will only be verified on the next release after merge).
• release-please.yml — verify after merge that the next release-please run on main opens a PR cleanly under googleapis/release-please-action@v5 (config schema is unchanged, so this is just exercising the runtime bump).