Bump `thrift` dependency past GHSA-r67j-r569-jrwp

[kylekennedy-spade]

Summary

@databricks/sql currently pins thrift at a version that's flagged by GHSA-r67j-r569-jrwp (Apache Thrift Node.js bindings vulnerable to uncontrolled recursion). Downstream consumers running npm audit --audit-level=high in CI are now seeing this fail with "No fix available" because the lockfile-resolved thrift version falls inside the advisory's affected range.

Can be reproduced in any project that depends on @databricks/sql@^1.13.0

Requested change

Bump the thrift peer/runtime dependency in @databricks/sql to a version outside the advisory range (the next patched release on or after 0.23.0)

[andyedwardsibm]

For clarity GHSA-r67j-r569-jrwp claims that @databricks/sql@0.23.0 thrift@0.23.0 is the fixed version

[andyedwardsibm]

There is also https://nvd.nist.gov/vuln/detail/CVE-2026-43870, which is also fixed by @databricks/sql@0.23.0 thrift@0.23.0

[kylekennedy-spade]

@andyedwardsibm thanks, good call - I'll update the issue. In your comments though, I think you mean to be referencing thrift@0.23.0 rather than @databricks/sql?

[andyedwardsibm]

Oo yes, my bad... fixing