Merge upstream/main: 62 commits (Contextual Sessions auth refactor, reader metadata refactor, bloom-filter/row-group perf, deletion-vector validation)

.asf.yaml

@@ -93,6 +93,7 @@ github:
     - c-thiel
     - mbutrovich
     - CTTY
+    - comphead
   ghp_branch: gh-pages
   ghp_path: /
   copilot_code_review:

.github/copilot-instructions.md

@@ -19,3 +19,15 @@ When reviewing pull requests, follow these rules to avoid noise and redundancy:
 - First-time contributors: For users new to this repository,
   explicitly instruct them to "Please check and address all review
   comments in this PR."
+
+Also flag these, once per PR with the locations:
+
+- Comment churn: Code comments or docs that restate the code, narrate
+  history, or justify review decisions.
+- Unrelated edits: Renames, reformatting, or reordering of code the
+  change does not otherwise need.
+- Duplication: New helpers, types, or tests that duplicate existing ones.
+- API growth: New public API the change does not need. Check new entries
+  in `public-api.txt`.
+- PR description: Descriptions that restate the diff or pad the
+  template. Mention it in the review summary.

crates/sqllogictest/testdata/schedules/df_create_table.toml → .github/labeler.yml

@@ -15,9 +15,7 @@
 # specific language governing permissions and limitations
 # under the License.
 
-[engines]
-df = { type = "datafusion" }
-
-[[steps]]
-engine = "df"
-slt = "df_test/create_table.slt"
+# Issue and pull request labeler configuration: https://github.com/github/issue-labeler
+# Labels issues and PRs whose title or body matches the regex.
+datafusion:
+  - '/datafusion/i'

.github/workflows/audit.yml

@@ -30,10 +30,7 @@ on:
       - "**/Cargo.lock"
 
   pull_request:
-    paths:
-      - "**/Cargo.toml"
-      - "**/Cargo.lock"
-      - ".github/workflows/audit.yml"
+  merge_group:
 
   schedule:
     - cron: '0 0 * * *'

.github/workflows/bindings_python_ci.yml

@@ -51,7 +51,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           version: "0.9.3"
           enable-cache: true
@@ -89,7 +89,7 @@ jobs:
         uses: $/.github/actions/setup-builder
       - name: Cache Rust artifacts
         if: runner.os != 'Linux'
-        uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: bindings-python
           save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
@@ -98,7 +98,7 @@ jobs:
           working-directory: "bindings/python"
           command: build
           args: --out dist -i python3.12 # Explicitly set interpreter; manylinux containers have multiple Pythons and maturin may pick an older one
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           version: "0.9.3"
           enable-cache: true

.github/workflows/ci.yml

@@ -57,9 +57,13 @@ jobs:
 
       - name: Install lint tools
         # Keep versions in sync with the local install targets in Makefile.
-        uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2.87.8
+        uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21
         with:
-          tool: taplo@0.9.3,cargo-machete@0.7.0
+          tool: taplo@0.9.3,cargo-machete@0.7.0,cargo-deny@0.19.9
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: 3.12
 
       - name: Check License Header
         uses: apache/skywalking-eyes/header@a196742f472feaffafea537ce5a2a4c3c53a8de4 # v0.9.0
@@ -79,6 +83,9 @@ jobs:
       - name: Check crates package LICENSE and NOTICE
         run: make check-license-notice
 
+      - name: Check dependency licenses
+        run: python3 ./dev/release/licenses.py dependencies check
+
       # Trusted publishing cannot create a crate (https://crates.io/docs/trusted-publishing),
       # so a new publishable crate must be reserved on crates.io before it is merged.
       # See "Adding a new crate" in website/src/release.md.
@@ -99,7 +106,7 @@ jobs:
         run: cargo machete
 
       - name: Check typos
-        uses: crate-ci/typos@d43b6c087ac471e2ea7b8af622ff15f05c0c365b # v1.50.1
+        uses: crate-ci/typos@512fc24f32f44ab01972217aaaf3dc86ec234d53 # v1.50.2
 
   clippy:
     needs: lint
@@ -137,7 +144,7 @@ jobs:
         uses: $/.github/actions/setup-builder
 
       - name: Cache Rust artifacts
-        uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
 
@@ -158,7 +165,7 @@ jobs:
         uses: $/.github/actions/setup-builder
 
       - name: Cache Rust artifacts
-        uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
 
@@ -199,7 +206,7 @@ jobs:
         uses: $/.github/actions/setup-builder
 
       - name: Cache Rust artifacts
-        uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
 
@@ -228,14 +235,14 @@ jobs:
         uses: $/.github/actions/setup-builder
 
       - name: Cache Rust artifacts
-        uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: ${{ matrix.test-suite.name }}
           save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
 
       - name: Install cargo-nextest
         if: matrix.test-suite.name == 'default'
-        uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2.87.8
+        uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21
         with:
           tool: cargo-nextest
 

.github/workflows/codeql.yml

@@ -46,11 +46,11 @@ jobs:
         persist-credentials: false
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
       with:
         languages: actions
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
       with:
         category: "/language:actions"

crates/sqllogictest/testdata/schedules/df_insert_and_like.toml → .github/workflows/labeler.yml

@@ -1,3 +1,4 @@
+#
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
 # distributed with this work for additional information
@@ -14,14 +15,28 @@
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
+#
 
-[engines]
-df = { type = "datafusion" }
+name: "Issue and Pull Request Labeler"
+on:
+  issues:
+    types: [opened, edited]
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
+    types: [opened, edited]
 
-[[steps]]
-engine = "df"
-slt = "df_test/insert_into.slt"
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
 
-[[steps]]
-engine = "df"
-slt = "df_test/like_predicate_pushdown.slt"
+jobs:
+  triage:
+    if: github.repository_owner == 'apache'
+    runs-on: ubuntu-slim
+    steps:
+    - uses: github/issue-labeler@ccca1e16fcb66762200e616fc29b57b940c1cb67 # v3.5
+      with:
+        configuration-path: .github/labeler.yml  # label -> regex rules
+        enable-versioned-regex: 0  # required; 0 = no versioned configs
+        include-title: 1  # match title
+        include-body: 1  # match body (default)

.github/workflows/public-api.yml

@@ -45,7 +45,7 @@ jobs:
         uses: $/.github/actions/setup-builder
 
       - name: Cache Rust artifacts
-        uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
 

.github/workflows/release_python.yml

@@ -1,3 +1,3 @@
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
 # distributed with this work for additional information
@@ -190,7 +190,7 @@
           working-directory: "bindings/python"
           command: build
           args: --release -o dist -i python3.12 # Explicitly set interpreter; manylinux containers have multiple Pythons and maturin may pick an older one
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           version: "0.9.3"
           enable-cache: true

.github/workflows/release_python_nightly.yml

@@ -1,3 +1,3 @@
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
 # distributed with this work for additional information
@@ -124,7 +124,7 @@
           command: build
           args: --release -o dist -i python3.12 # Explicitly set interpreter; manylinux containers have multiple Pythons and maturin may pick an older one
 
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           version: "0.9.3"
           enable-cache: true

.github/workflows/zizmor.yml

@@ -37,6 +37,6 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
         with:
           advanced-security: false

.licenserc.yaml

@@ -27,8 +27,6 @@ header:
     - "**/*.json"
     # Generated content by mdbook
     - "website/book"
-    # Generated content by scripts
-    - "**/DEPENDENCIES.*.tsv"
     # Generated content by cargo-public-api
     - "**/public-api.txt"
     # Generated content by trybuild

AGENTS.md

@@ -22,6 +22,44 @@
 This file provides repository-specific guidance for automated agents working
 in this repository.
 
+## Comments, docs, and diff scope
+
+Default to no comment. Leave existing comments as they are unless you change
+the code they describe or they are wrong.
+
+- Comment only what the code cannot say: invariants, non-obvious
+  constraints, links to external behavior. Do not restate the code.
+- Do not describe how the code changed or explain review history
+  ("previously", "instead of", "unlike X"). Put that in the commit message
+  or PR description.
+- Public items get a one-line doc summary of what they do for the caller,
+  not how. Expand only for contract the caller must know, such as the
+  errors it returns (`# Errors`) or when it panics (`# Panics`).
+- Test names say what they check. Do not narrate asserts.
+- Cover the edge cases and error paths the change adds, not only the
+  happy path.
+- Build the expected value and assert equality with it, rather than
+  checking fields one at a time.
+- Do not add tests that duplicate existing coverage.
+- Do not rename, reformat, refactor, or reorder code unrelated to the
+  change. A bug fix does not carry an API redesign.
+- Reuse existing helpers, types, and test fixtures (such as
+  `TableTestFixture`) before adding new ones. Use arrow-rs kernels
+  instead of reimplementing them.
+- Use the narrowest visibility that works. Make items `pub` only when they
+  are part of the API the change intends to expose. Run
+  `make generate-public-api` to update each crate's `public-api.txt`, and
+  check its diff for API growth.
+
+## Pull requests
+
+- Follow the PR template. Keep each section short: the problem, the
+  approach, and anything a reviewer would not guess from the diff. In
+  AI Disclosure, name the areas of uncertainty or assumptions a reviewer
+  should focus on.
+- Do not restate the diff: no file-by-file walkthroughs, per-function
+  summaries, or "changes made" checklists.
+
 ## Security Model
 
 When assessing potential vulnerabilities or calibrating automated security

CHANGELOG.md

@@ -24,6 +24,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [Unreleased]
+
+### Breaking Changes
+
+* `FileWrite::close`, `EncryptedOutputFile::write`, `ManifestListWriter::close`, and `PuffinWriter::close` now return `Result<io::FileMetadata>` instead of `Result<()>`. The returned size is the on-disk size, including encryption overhead. Custom `FileWrite` implementations must return the number of bytes stored.
+* `EncryptedOutputFile::key_metadata()` is replaced by `key_metadata_with_saved_file_metadata(&FileMetadata)`. Pass the metadata returned by `write()` or the writer's `close()` to include the stored length before encoding key metadata.
+* `EncryptedInputFile::metadata()` is now synchronous and derives the plaintext size from key metadata without a storage stat. Remove `.await` from calls to this method.
+* AGS1 readers now require `StandardKeyMetadata::file_length` and reject missing or invalid lengths without falling back to a storage stat. AGS1-encrypted manifests, manifest lists, and Puffin files written by earlier development builds without this field must be rewritten using a build that can still read them before upgrading. This matches the Java client's read contract.
+* `iceberg_catalog_loader::BoxedCatalogBuilder` has a new required method, `with_runtime`. Types implementing `CatalogBuilder` get it through the blanket impl; types implementing `BoxedCatalogBuilder` directly (for example, a wrapper around another `Box<dyn BoxedCatalogBuilder>`) must implement it, typically by forwarding the runtime to the builder they wrap.
+
 ## [v0.10.1] - 2026-07-28
 
 * chore: Update crossbeam-epoch to 0.9.20, pin CI ruff version to 0.15.22 by @dannycjones in https://github.com/apache/iceberg-rust/pull/2911

CONTRIBUTING.md

@@ -118,6 +118,14 @@ tested in CI and developers have reproducible builds.
 In `Cargo.toml`, we specify the minimum version required to use iceberg-rust. This allows users to choose their
 dependency versions without always upgrading to the latest.
 
+Dependency licenses must comply with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html).
+CI checks them against `deny.toml` with `cargo deny`; run `make check-dependency-licenses` to check locally. If a
+license is rejected, find its category in the policy:
+
+- Category A: add the license to `allow`.
+- Category B: add a per-crate entry to `exceptions`.
+- Category X: not allowed by ASF policy; do not take the dependency.
+
 ## Code of Conduct
 
 We expect all community members to follow our [Code of Conduct](https://www.apache.org/foundation/policies/conduct.html).