[StefanSteiner]

Summary

cargo-audit and cargo-deny started failing on main after RustSec published new advisories on Oct 9-14. The last napi-rs merge (#356) was not the cause. This clears them.

• zip 8 -> 9 (RUSTSEC-2026-0367, 0368, 0369). No source changes were needed: extract_hyperd walks entries itself with enclosed_name() and never calls ZipArchive::extract, so it was not on the vulnerable path.
• rustls 0.23.46, rustls-webpki 0.103.16, webpki-roots / webpki-root-certs 1.0.10 (RUSTSEC-2026-0346 to 0349 and related). Lockfile only.
• smallvec, tokio-util, zeroize, toml patch bumps, folding in the open Dependabot PRs chore(deps)(deps): bump smallvec from 1.16.2 to 1.16.3 #357 to chore(deps)(deps): bump toml from 1.1.6+spec-1.1.0 to 1.1.8+spec-1.1.0 #360.

Two commits, so the security fix can be reverted separately from the patch bumps.

Verification

Run locally on the final tree against the pinned hyperd 0.0.26479:

• cargo audit --deny warnings: exit 0
• cargo deny check: advisories, bans, licenses, sources ok
• cargo fmt --check, cargo clippy --workspace --all-targets --all-features -- -D warnings, cargo doc with -D warnings: clean
• make test: 2050 passed, 0 failed, 51 ignored
• cargo +1.88 check -p hyperdb-bootstrap --locked: passes (MSRV)
• make download-hyperd verified the wheel SHA and installed hyperd through the new zip 9 code

Not run locally: the hyperdb-api-node build/smoke test (CI covers it).

Known leftover

The cargo-deny job also logs override toolchain 'stable-x86_64-unknown-linux-musl' is not installed (RUSTUP_TOOLCHAIN=stable inside the action's container). That is separate from the advisories and is not addressed here.

Supersedes #357, #358, #359, #360.