Update duckdb and arrow

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
arrow	dependencies	minor	=58.1.0 → =58.3.0
arrow-ipc	dependencies	minor	=58.1.0 → =58.3.0
duckdb	dependencies	minor	=1.10501.0 → =1.10503.1	1.10504.0

---

Release Notes

duckdb/duckdb-rs (duckdb)

v1.10503.1

Compare Source

What's Changed

• Avoid Windows mtime restore in bundled builds by @​mlafeldt in #​766
• Add patch-release mode to upgrade script by @​mlafeldt in #​767
• Crate patch release v1.10503.1 by @​mlafeldt in #​768

Full Changelog: duckdb/duckdb-rs@v1.10503.0...v1.10503.1

v1.10503.0

Compare Source

Highlights

• New ergonomic named parameter binding: named_params! macro, &[(&str, &dyn ToSql)] slices, and a generic HashMap Params impl.
• New build env vars: DUCKDB_DISABLE_EXTENSION_LOAD=1 disables extension install/load, and DUCKDB_DISABLE_JEMALLOC=1 opts bundled-cmake builds out of jemalloc (now re-enabled by default on supported targets).
• FFI soundness: typed vector slice/set_child APIs are now unsafe; DuckDB-owned C strings use RAII; binding unsupported Value variants errors instead of panicking.
• ArrowVTab view rebinds no longer dereference freed Arrow FFI memory.
• vtab::Value gains typed primitive getters and to_list() -> Option<Vec<Value>>.
• Bundled DuckDB upgraded to v1.5.3 (adds VARIANT metadata).

What's Changed

• Fix unsound vector slice API by @​mlafeldt in #​745
• Refine vtab::Value API from #​676 by @​mlafeldt in #​747
• Build out vtab::Value to enable more diverse parameters to Table Functions by @​marksomething in #​676
• Bump rustls-webpki from 0.103.11 to 0.103.13 by @​dependabot[bot] in #​744
• Add ergonomic named parameter binding by @​mlafeldt in #​748
• Implement Params for HashMap and serde_json::Value by @​ryanschneider in #​615
• Harden DuckDB-owned string handling at FFI boundaries by @​mlafeldt in #​750
• Update Rust to 1.95 by @​mlafeldt in #​751
• Stop panicking when binding/appending unsupported Value variants by @​mlafeldt in #​749
• Fix ArrowVTab view rebind lifetime by @​mlafeldt in #​754
• Retain ArrowVTab batches for sanitizer visibility by @​mlafeldt in #​755
• Pass Rust edition to rust.vim for proper formatting by @​mlafeldt in #​756
• Make DuckDB source archive reproducible by @​mlafeldt in #​759
• Change LogicalTypeHandle::set_alias to take &mut self by @​vergenzt in #​758
• libduckdb-sys: expose DEP_DUCKDB_INCLUDE for downstream C/C++ shims by @​frhack in #​753
• Update DuckDB to v1.5.3 by @​mlafeldt in #​760
• Allow to disable extension install/load support by @​mlafeldt in #​738
• Use improved upstream extension loader by @​mlafeldt in #​746
• Stop disabling jemalloc in bundled-cmake builds by @​mlafeldt in #​762
• Add bundled-cmake jemalloc escape hatch by @​mlafeldt in #​763

New Contributors

• @​marksomething made their first contribution in #​676
• @​ryanschneider made their first contribution in #​615
• @​vergenzt made their first contribution in #​758
• @​frhack made their first contribution in #​753

Full Changelog: duckdb/duckdb-rs@v1.10502.0...v1.10503.0

v1.10502.0

Compare Source

Highlights

• Lifetime-safe vectors: FlatVector, ListVector, ArrayVector, and StructVector now carry a lifetime parameter tied to DataChunkHandle, preventing use-after-free bugs. Breaking: these types must be written as FlatVector<'_>, etc.
• Static DuckDB extensions (experimental): new bundled-cmake feature builds DuckDB through upstream CMake, enabling static extensions like icu. Checkout-only for now.
• Upgraded to bundled DuckDB v1.5.2.

What's Changed

• Restrict Dependabot to direct dependencies by @​mlafeldt in #​719
• Disable routine dependabot version PRs by @​mlafeldt in #​730
• Add -c flag to example REPL for testing by @​mlafeldt in #​735
• Update Cargo.lock and pin comfy-table by @​mlafeldt in #​736
• Tie vector lifetimes to DataChunkHandle by @​mlafeldt in #​737
• Enable static DuckDB extensions via Cargo in checkouts by @​mlafeldt in #​732
• Update DuckDB to v1.5.2 by @​mlafeldt in #​741

Full Changelog: duckdb/duckdb-rs@v1.10501.0...v1.10502.0

---

Configuration

📅 Schedule: (in timezone Australia/Brisbane)

• Branch creation
  • "after 8am on saturday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cubic-dev-ai]

No issues found across 2 files

[sentry]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.25%. Comparing base (7dd0ddf) to head (a960b37).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #33   +/-   ##
=======================================
  Coverage   91.25%   91.25%           
=======================================
  Files          12       12           
  Lines        2070     2070           
=======================================
  Hits         1889     1889           
  Misses        181      181           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.