dependabot · Oct 14, 2026
diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
@@ -22,7 +22,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2.87.24
+      - uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27
         with:
           tool: cargo-audit@0.22.2
       # Invoke the binary directly: no Rust toolchain is needed to read Cargo.lock.

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
         run: |
           sudo apt-get update -o Dir::Etc::sourcelist="sources.list.d/ubuntu.sources" -o Dir::Etc::sourceparts="-"
           sudo apt-get install -y clang libclang-dev cmake pkg-config libssl-dev
-      - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 (master); the toolchain input selects Rust
+      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 (master); the toolchain input selects Rust
         with:
           toolchain: '1.97.1'
           components: rustfmt,clippy,rust-docs
@@ -34,7 +34,7 @@ jobs:
       - run: cargo test --locked --workspace --all-targets
         env:
           FLOW_V3_EXPORT: ${{ runner.temp }}/flow-v3-reader
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       - name: Independent Iceberg v3 reader
         run: uv run tests/local/v3_reader.py "$RUNNER_TEMP/flow-v3-reader"
       - name: Python fixture regressions
@@ -61,7 +61,7 @@ jobs:
         run: |
           sudo apt-get update -o Dir::Etc::sourcelist="sources.list.d/ubuntu.sources" -o Dir::Etc::sourceparts="-"
           sudo apt-get install -y clang libclang-dev cmake pkg-config libssl-dev
-      - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 (master); the toolchain input selects Rust
+      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 (master); the toolchain input selects Rust
         with:
           toolchain: '1.97.1'
           components: clippy,rust-docs
@@ -94,7 +94,7 @@ jobs:
         run: |
           sudo apt-get update -o Dir::Etc::sourcelist="sources.list.d/ubuntu.sources" -o Dir::Etc::sourceparts="-"
           sudo apt-get install -y clang libclang-dev cmake pkg-config libssl-dev
-      - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 (master); the toolchain input selects Rust
+      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 (master); the toolchain input selects Rust
         with:
           toolchain: '1.94.0'
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
@@ -31,7 +31,7 @@ jobs:
         run: |
           sudo apt-get update -o Dir::Etc::sourcelist="sources.list.d/ubuntu.sources" -o Dir::Etc::sourceparts="-"
           sudo apt-get install -y clang libclang-dev cmake pkg-config libssl-dev
-      - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 (master); the toolchain input selects Rust
+      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 (master); the toolchain input selects Rust
         with:
           toolchain: '1.97.1'
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
@@ -45,7 +45,7 @@ jobs:
           docker build -f tests/production/Dockerfile.minio --target client -t flow-test-mc:RELEASE.2025-04-16T18-13-26Z tests/production
           docker save -o "$RUNNER_TEMP/minio-images.tar" flow-test-minio:RELEASE.2025-04-22T22-12-26Z flow-test-mc:RELEASE.2025-04-16T18-13-26Z
           tar -cf "$RUNNER_TEMP/daemon.tar" target/debug/embrasure-flow
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: nightly-inputs
           path: |
@@ -76,15 +76,15 @@ jobs:
       SEED: ${{ github.event.inputs.seed }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: nightly-inputs
           path: ${{ runner.temp }}/nightly-inputs
       - name: Unpack the daemon and load MinIO fixture images
         run: |
           tar -xf "$RUNNER_TEMP/nightly-inputs/daemon.tar"
           docker load -i "$RUNNER_TEMP/nightly-inputs/minio-images.tar"
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       - name: Select free service ports
         run: |
           python3 - <<'PY'
@@ -126,7 +126,7 @@ jobs:
       - name: Service logs
         if: always()
         run: docker compose logs --no-color > "$RUNNER_TEMP/service-containers.log"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: nightly-${{ matrix.run }}

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -97,7 +97,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y clang libclang-dev cmake pkg-config libssl-dev
-      - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 (master); the toolchain input selects Rust
+      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 (master); the toolchain input selects Rust
         with:
           toolchain: '1.97.1'
       - name: Test in the release profile
@@ -156,7 +156,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y clang libclang-dev cmake pkg-config libssl-dev
-      - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 (master); the toolchain input selects Rust
+      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 (master); the toolchain input selects Rust
         with:
           toolchain: '1.97.1'
       - name: Build
@@ -175,7 +175,7 @@ jobs:
           "dist/$name/embrasure-flow" --version
           tar -C dist -czf "dist/$name.tar.gz" "$name"
           (cd dist && sha256sum "$name.tar.gz" > "$name.tar.gz.sha256")
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: binaries-${{ matrix.target }}
           path: dist/*.tar.gz*
@@ -232,7 +232,7 @@ jobs:
         run: |
           mkdir -p digests
           touch "digests/${DIGEST#sha256:}"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: digest-${{ strategy.job-index }}
           path: digests/*
@@ -245,7 +245,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: digest-*
           path: digests
@@ -279,7 +279,7 @@ jobs:
         with:
           ref: ${{ env.TAG }}
           persist-credentials: false
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: binaries-*
           path: dist

diff --git a/.github/workflows/services.yml b/.github/workflows/services.yml
@@ -25,7 +25,7 @@ jobs:
         run: |
           sudo apt-get update -o Dir::Etc::sourcelist="sources.list.d/ubuntu.sources" -o Dir::Etc::sourceparts="-"
           sudo apt-get install -y clang libclang-dev cmake pkg-config libssl-dev
-      - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 (master); the toolchain input selects Rust
+      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1 (master); the toolchain input selects Rust
         with:
           toolchain: '1.97.1'
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
@@ -52,7 +52,7 @@ jobs:
           binaries=(target/debug/embrasure-flow target/debug/examples/local_compactor target/debug/snapshot_timeout_tests target/debug/schema_batch_tests target/debug/superset_publication_tests target/debug/daemon_tests)
           sha256sum "${binaries[@]}" > target/service-binaries.sha256
           tar -cf "$RUNNER_TEMP/service-binaries.tar" "${binaries[@]}" target/service-binaries.sha256
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: service-binaries
           path: ${{ runner.temp }}/service-binaries.tar
@@ -70,7 +70,7 @@ jobs:
           docker build -f tests/production/Dockerfile.minio --target server -t flow-test-minio:RELEASE.2025-04-22T22-12-26Z tests/production
           docker build -f tests/production/Dockerfile.minio --target client -t flow-test-mc:RELEASE.2025-04-16T18-13-26Z tests/production
           docker save -o "$RUNNER_TEMP/minio-images.tar" flow-test-minio:RELEASE.2025-04-22T22-12-26Z flow-test-mc:RELEASE.2025-04-16T18-13-26Z
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: minio-images
           path: ${{ runner.temp }}/minio-images.tar
@@ -125,15 +125,15 @@ jobs:
       RUST_LOG: info
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: service-binaries
           path: ${{ runner.temp }}/service-binaries
       - name: Unpack and verify service binaries
         run: |
           tar -xf "$RUNNER_TEMP/service-binaries/service-binaries.tar"
           sha256sum -c target/service-binaries.sha256
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: minio-images
           path: ${{ runner.temp }}/minio-images
@@ -142,7 +142,7 @@ jobs:
       - name: Reserve disk for independent reader images
         if: matrix.suite == 'readers' || matrix.suite == 'v3'
         run: sudo rm -rf /usr/local/lib/android /usr/share/dotnet
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       - name: Verify stock reader extensions from an empty cache
         run: uv run tests/local/duckdb_extensions.py
       - name: Select free ports that survive service restarts
@@ -387,7 +387,7 @@ jobs:
       - name: Service logs
         if: always()
         run: docker compose logs --no-color > "$RUNNER_TEMP/service-containers.log"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: services-pg-${{ matrix.postgres }}-${{ matrix.suite }}
@@ -422,21 +422,21 @@ jobs:
       RUST_LOG: info
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: service-binaries
           path: ${{ runner.temp }}/service-binaries
       - name: Unpack and verify service binaries
         run: |
           tar -xf "$RUNNER_TEMP/service-binaries/service-binaries.tar"
           sha256sum -c target/service-binaries.sha256
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: minio-images
           path: ${{ runner.temp }}/minio-images
       - name: Load MinIO fixture images
         run: docker load -i "$RUNNER_TEMP/minio-images/minio-images.tar"
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       - name: Select free service ports
         run: |
           python3 - <<'PYPORTS'
@@ -479,7 +479,7 @@ jobs:
       - name: Service logs
         if: always()
         run: docker compose logs --no-color > "$RUNNER_TEMP/service-containers.log"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: services-pgvector