Merge upstream/main: bloom filters, row lineage, new REST auth architecture

.asf.yaml

@@ -36,15 +36,51 @@ github:
   protected_branches:
     main:
       required_status_checks:
-        # strict means "Require branches to be up to date before merging".
-        strict: true
+        # Check context names (job names, not workflow files) that Merge Queue
+        # waits for. Every producer workflow must run on both `pull_request`
+        # and `merge_group`, without path filters, so each context always
+        # reports. `strict` is omitted: Merge Queue validates every entry
+        # against an up-to-date main, and ASF defaults it to false.
+        contexts:
+          # Repository policy and security checks.
+          - Analyze Actions
+          - Run zizmor 🌈
+          - asf-allowlist-check
+
+          # Rust workflow gates.
+          - ci-required
+          - check-public-api
+
+          # Python bindings workflow gates.
+          - bindings-python-ci-required
 
       required_pull_request_reviews:
         required_approving_review_count: 1
         dismiss_stale_reviews: false
 
       required_linear_history: true
+  rulesets:
+    - name: Merge Queue
+      target: branch
+      enforcement: active
+      conditions:
+        ref_name:
+          include:
+            - "~DEFAULT_BRANCH"
+          exclude: []
+      rules:
+        - type: merge_queue
+          parameters:
+            check_response_timeout_minutes: 90
+            grouping_strategy: ALLGREEN
+            max_entries_to_build: 1
+            max_entries_to_merge: 1
+            merge_method: SQUASH
+            min_entries_to_merge: 1
+            min_entries_to_merge_wait_minutes: 0
   pull_requests:
+    # allow pull requests to merge automatically once all requirements are met
+    allow_auto_merge: true
     # auto-delete head branches after being merged
     del_branch_on_merge: true
   features:

.cargo/audit.toml

@@ -21,37 +21,10 @@ ignore = [
   # Marvin Attack: potential key recovery through timing sidechannels
   # Issues: https://github.com/apache/iceberg-rust/issues/221
   "RUSTSEC-2023-0071",
-  # `derivative` is unmaintained; consider using an alternative
-  #
-  # Introduced by hive_metastore, tracked at https://github.com/cloudwego/pilota/issues/293
-  "RUSTSEC-2024-0388",
   # `paste` is unmaintained; consider using an alternative
   #
   # Introduced by hive_metastore, tracked at https://github.com/cloudwego/pilota/issues/293
   "RUSTSEC-2024-0436",
-  # `generational-arena` is unmaintained; consider using an alternative
-  #
-  # Introduced by datafusion-ffi through abi_stable/async-ffi until upstream
-  # provides a replacement path.
-  "RUSTSEC-2024-0014",
-  # `rustls-pemfile` is unmaintained
-  #
-  # Introduced by object_store, see https://github.com/apache/arrow-rs-object-store/issues/564
-  "RUSTSEC-2025-0134",
-  # `rand` unsoundness with custom logger using `rand::rng()`
-  #
-  # Direct dependency upgraded to 0.9.3+. Transitive rand 0.8.5 remains
-  # from reqsign/sqllogictest/rustc-hash — no 0.8.x patch exists.
-  "RUSTSEC-2026-0097",
-  # pyo3 < 0.29: out-of-bounds read in PyList/PyTuple `nth`/`nth_back`, and
-  # missing `Sync` bound on `PyCFunction::new_closure` closures.
-  #
-  # Pulled only transitively through arrow's `pyarrow` feature
-  # (arrow-pyarrow), which still pins pyo3 ^0.28 in its latest release; no
-  # arrow build supports the patched pyo3 0.29 yet. Remove once arrow-pyarrow
-  # moves to pyo3 >=0.29.
-  "RUSTSEC-2026-0176",
-  "RUSTSEC-2026-0177",
   # `quick-xml` < 0.41.0 has quadratic duplicate-attribute validation and
   # unbounded namespace-declaration allocation (parser DoS).
   #

.gitattributes

@@ -1 +1,12 @@
+# Paths left out of the source archive built by dev/release/create_rc.sh.
+# Files needed to build, test, and verify from source (dev/, .licenserc.yaml,
+# lint configs) must stay in.
+#
+# .github must stay in too: `uses: $/...` action references are resolved from
+# the repository archive, which honors export-ignore.
 website export-ignore
+.asf.yaml export-ignore
+.devcontainer export-ignore
+.gitattributes export-ignore
+.gitignore export-ignore
+.idea export-ignore

.github/ISSUE_TEMPLATE/iceberg_bug_report.yml

@@ -22,19 +22,15 @@ description: Problems, bugs and issues with Apache Iceberg Rust
 labels: bug
 
 body:
-  - type: dropdown
+  - type: input
     attributes:
       label: Apache Iceberg Rust version
-      description: What Apache Iceberg Rust version are you using?
-      multiple: false
-      options:
-        - 0.6.0 (latest version)
-        - 0.5.1
-        - 0.4.0
-        - 0.3.0
-        - 0.2.0
+      description: >
+        What Apache Iceberg Rust version are you using?
+      placeholder: >
+        For example: v0.10.0
     validations:
-      required: false
+      required: true
   - type: textarea
     attributes:
       label: Describe the bug

.github/dependabot.yml

@@ -21,8 +21,7 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
-      day: "sunday"
+      interval: "monthly"
     cooldown:
       default-days: 7
     groups:
@@ -37,8 +36,7 @@ updates:
   - package-ecosystem: "cargo"
     directory: "/"
     schedule:
-      interval: "weekly"
-      day: "sunday"
+      interval: "monthly"
     open-pull-requests-limit: 50
     versioning-strategy: lockfile-only
     ignore:
@@ -58,7 +56,6 @@ updates:
   - package-ecosystem: "uv"
     directory: "/bindings/python"
     schedule:
-      interval: "weekly"
-      day: "sunday"
+      interval: "monthly"
     cooldown:
       default-days: 7

.github/workflows/asf-allowlist-check.yml

@@ -25,9 +25,7 @@ name: "ASF Allowlist Check"
 
 on:
   pull_request:
-  push:
-    branches:
-      - main
+  merge_group:
 
 permissions:
   contents: read
@@ -39,4 +37,9 @@ jobs:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
+    # The allowlist checker recognizes ./, but not $/, as a local action prefix.
+    # Normalize its disposable checkout while preserving $/ in source workflows.
+    - name: Normalize self-repository references for the allowlist checker
+      run: |
+        find .github -type f -name '*.yml' -exec sed -i 's#uses: \$/#uses: ./#g' {} +
     - uses: apache/infrastructure-actions/allowlist-check@61dcea11f19e2bbe1263f14d72235e8da17d3ad0  # allowlist-check/v1.0.0

.github/workflows/audit.yml

@@ -53,7 +53,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup Rust toolchain
-        uses: ./.github/actions/setup-builder
+        uses: $/.github/actions/setup-builder
         with:
           rust-version: stable
       - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0

.github/workflows/bindings_python_ci.yml

@@ -21,7 +21,6 @@ on:
   push:
     branches:
       - main
-  pull_request:
     paths:
       - '**'                                       # Include all files and directories in the repository by default.
       - '!.github/ISSUE_TEMPLATE/**'               # Exclude files and directories that don't impact tests or code like templates, metadata, and documentation.
@@ -35,6 +34,8 @@ on:
       - '!LICENSE'
       - '!NOTICE'
       - '!README.md'
+  pull_request:
+  merge_group:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
@@ -56,7 +57,7 @@ jobs:
           enable-cache: true
       - name: Install tools
         run: |
-          uv tool install ruff
+          uv tool install ruff@0.15.22
       - name: Check format
         working-directory: "bindings/python"
         run: |
@@ -85,7 +86,7 @@ jobs:
       # Linux maturin builds may run inside manylinux Docker, so host Rust caches only help Windows/macOS.
       - name: Setup Rust toolchain
         if: runner.os != 'Linux'
-        uses: ./.github/actions/setup-builder
+        uses: $/.github/actions/setup-builder
       - name: Cache Rust artifacts
         if: runner.os != 'Linux'
         uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
@@ -121,3 +122,17 @@ jobs:
           HF_DATASET: ${{ secrets.HF_DATASET }}
         run: |
           make test
+
+  bindings-python-ci-required:
+    if: ${{ always() }}
+    needs: [check-python, test]
+    runs-on: ubuntu-slim
+    steps:
+      - name: Verify Bindings Python CI jobs succeeded
+        env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          read -ra results <<< "$RESULTS"
+          for result in "${results[@]}"; do
+            test "$result" = "success"
+          done