Release v0.9.0: quack-rs 0.15.0, DuckDB v1.5.4, dependency refresh#83
Merged
Conversation
Bump the two runtime dependencies and the DuckDB target to the current release line, refresh the full lockfile (picking up security fixes), and cut the v0.9.0 release. Zero changes to extension source — the SDK and C ABI are unchanged, so the crate compiles against the new deps untouched. Dependencies: - quack-rs 0.14.0 -> 0.15.0 (additive: adds Value::as_blob and fixes VectorReader::read_blob; neither blob API is used here). MSRV stays 1.87. - libduckdb-sys and duckdb (dev) 1.10503.1 -> 1.10504.0 (DuckDB v1.5.4 bugfix release; C extension API stays v1.2.0, ABI stays C_STRUCT_UNSTABLE). - cargo update: crossbeam-epoch 0.9.18 -> 0.9.20 (RUSTSEC-2026-0204) and quinn-proto 0.11.14 -> 0.11.16 (RUSTSEC-2026-0185), plus routine bumps. All are dev/transitive; the shipped .so links only libduckdb-sys + quack-rs. libduckdb-sys 1.10504.0 also drops the windows-sys subtree. Version pins updated to v1.5.4: Makefile (TARGET/TEST), e2e.yml, and scripts/setup.sh. Extension version 0.8.0 -> 0.9.0 in Cargo.toml and description.yml. Docs: refreshed every version reference to the 0.9.0 / quack-rs 0.15.0 / DuckDB v1.5.4 baseline across README, CLAUDE.md, SECURITY.md, docs/src, issue templates, and the community-submission workflow; added the CHANGELOG [0.9.0] entry. Also corrected pre-existing drift: README CI-job count 13 -> 14 (was missing wasm-check), README E2E row 11 steps/59 queries -> 12 steps/76 queries (verified against e2e.yml and test/sql), and a stale Cargo.toml dev-dep comment referencing a nonexistent .cargo/config.toml. Validated locally (release build path needs no libduckdb download): release cdylib build, clippy --lib -D warnings, cargo fmt --check, cargo doc --no-deps (-D warnings), MSRV 1.87 lib compile, a full-tree MSRV audit (306 locked crates, all declare rust-version <= 1.87), and cargo-deny check advisories/bans/licenses/sources (clean). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KtQVSn8MZwxq6vJkLoS83a
The in-process integration test hardcodes the DuckDB release version it stamps into the extension metadata footer (the -dv field), documented as "kept in sync with the Makefile / e2e.yml". The v0.9.0 bump moved those to v1.5.4 but this .rs constant was missed by the earlier doc sweep (which only covered .md/.yml/.toml/.sh). The 16 integration tests passed anyway because they SET allow_extensions_metadata_mismatch=true; with the constant corrected the built artifact now carries the true v1.5.4 target, identical to what CI ships. Noted in the CHANGELOG version-sweep list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KtQVSn8MZwxq6vJkLoS83a
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Dependency-refresh release v0.9.0: upgrades quack-rs 0.14.0 → 0.15.0 and DuckDB v1.5.3 → v1.5.4 (
libduckdb-sys/duckdb1.10503.1 → 1.10504.0), refreshes the full lockfile (including two RUSTSEC dev/transitive security fixes), bumps the extension version, and updates every version reference and doc. Zero changes to extension source — the SDK API and DuckDB C ABI are unchanged, so the crate compiles against the new dependencies untouched.Changes
Value::as_blob,read_blobnon-UTF-8 fix); neither blob API is used here. MSRV stays 1.87.libduckdb-sys/duckdb1.10503.1 → 1.10504.0; C extension API staysv1.2.0, ABI staysC_STRUCT_UNSTABLE. Pins updated inMakefile,e2e.yml,scripts/setup.sh, and theDUCKDB_VERSIONmetadata constant intests/extension_load.rs.cargo update—crossbeam-epoch0.9.18 → 0.9.20 (RUSTSEC-2026-0204) andquinn-proto0.11.14 → 0.11.16 (RUSTSEC-2026-0185), both dev/transitive (never linked into the shipped.so), plus ~70 routine bumps; thewindows-systransitive subtree is dropped.Cargo.toml+description.yml;CHANGELOG[0.9.0]entry added.README.md,CLAUDE.md,SECURITY.md,docs/src/**, the issue templates, and the community-submission workflow.wasm-check) and E2E row 11 steps/59 queries → 12 steps/76 queries (verified againste2e.yml/test/sql); corrected a staleCargo.tomldev-dep comment referencing a nonexistent.cargo/config.toml.Type of Change
Primarily a dependency-refresh / release-prep change; no runtime source changes, so no SQL behavior changes.
Testing
All validated locally against real DuckDB v1.5.4 (libduckdb sourced from the DuckDB 1.5.4 pip wheel + the vendored amalgamation headers — the session's egress policy blocks the GitHub release download, and
duckdb/duckdbcan't be added cross-owner):cargo testpasses — 486 unit + 16 integration + 1 doc-test (503 total, 0 failed, 0 ignored)cargo clippy --all-targets— zero warningscargo fmt -- --checkpassescargo doc --no-depsbuilds without warnings (RUSTDOCFLAGS=-Dwarnings)behavioral_version()via the official DuckDB 1.5.4 Python client, and all 76test/sqlqueries pass (the exact setmake test_releaseruns)cargo bench --no-runcompiles all 7 suitesAdditional CI gates verified locally:
wasm-check(wasm32-unknown-emscripten), MSRV 1.87 (lib compile + full-tree audit: 306 locked crates, all declare rust-version ≤ 1.87), andcargo deny check advisories bans licenses sources(clean). SemVer is unaffected — the public rlib API is byte-identical (nosrc/changes).Documentation
[0.9.0])Related Issues
None.
Notes
Post-merge release path (verified ready):
v0.9.0→release.ymlvalidates versions (Cargo.toml = description.yml = 0.9.0 ✓), builds the 4-platform artifacts, runsmake test_release, creates the GitHub release, and auto-pinsdescription.yml'srefto the tagged commit onmain(theupdate-description-refjob).duckdb/community-extensions: runcommunity-submission.yml(dry_run=false) to generate the package, then open the PR updatingextensions/behavioral/description.yml.The
description.ymlrefstill points at the v0.8.0 commit by design —release.ymlrewrites it to the tagged commit automatically, so no manual edit is needed before tagging.🤖 Generated with Claude Code
https://claude.ai/code/session_01KtQVSn8MZwxq6vJkLoS83a
Generated by Claude Code