duckdb 1.4.1 → 1.4.2

package/.github/workflows/NodeJS.yml

@@ -13,29 +13,32 @@ env:
   GH_TOKEN: ${{ secrets.GH_TOKEN }}
   AWS_ACCESS_KEY_ID: ${{secrets.S3_DUCKDB_NODE_ID}}
   AWS_SECRET_ACCESS_KEY: ${{secrets.S3_DUCKDB_NODE_KEY}}
-  AWS_DEFAULT_REGION: us-east-1
+  AWS_ENDPOINT_URL: ${{ secrets.S3_DUCKDB_NODE_ENDPOINT }}
 
 jobs:
   set-up-npm:
-    name: Set up NPM
-    runs-on: ubuntu-22.04
+    name: Upload to NPM
+    runs-on: ubuntu-latest
     env:
       DUCKDB_NODE_BUILD_CACHE: 0
+    permissions: # only this job has permission to upload to npm using trusted publishing
+      id-token: write  # Required for OIDC
+      contents: read
     steps:
       - uses: actions/checkout@v3
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-node@v4
         with:
-          python-version: '3.11'
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Setup NPM
         shell: bash
         run: ./scripts/node_version.sh upload
         env:
           DUCKDB_NODE_BUILD_CACHE: 0  # create a standalone package
-          NODE_AUTH_TOKEN: ${{secrets.NODE_AUTH_TOKEN}}
 
   linux-nodejs:
     name: node.js Linux

package/package.json

@@ -2,13 +2,13 @@
   "name": "duckdb",
   "main": "./lib/duckdb.js",
   "types": "./lib/duckdb.d.ts",
-  "version": "1.4.1",
+  "version": "1.4.2",
   "description": "DuckDB node.js API",
   "gypfile": true,
   "dependencies": {
     "@mapbox/node-pre-gyp": "^2.0.0",
     "node-addon-api": "^7.0.0",
-    "node-gyp": "^9.3.0"
+    "node-gyp": "^9.4.1"
   },
   "binary": {
     "module_name": "duckdb",

package/scripts/node_version.sh

@@ -5,6 +5,7 @@ set -ex
 git config --global user.email "quack@duckdb.org"
 git config --global user.name "DuckDB Admin"
 
+npm -v
 
 export TAG=''
 # for main do prereleases
@@ -28,6 +29,5 @@ npm pack --dry-run
 # upload to npm, maybe
 if [[ "$GITHUB_REF" =~ ^(refs/heads/main|refs/tags/v.+)$ && "$1" = "upload" ]] ; then
 	npm version
-	npm config set //registry.npmjs.org/:_authToken $NODE_AUTH_TOKEN
 	npm publish --access public $TAG
 fi

package/src/duckdb/extension/icu/icu_extension.cpp

@@ -5,11 +5,8 @@
 #include "duckdb/function/scalar_function.hpp"
 #include "duckdb/main/config.hpp"
 #include "duckdb/main/connection.hpp"
-#include "duckdb/main/database.hpp"
 #include "duckdb/main/extension/extension_loader.hpp"
 #include "duckdb/parser/parsed_data/create_collation_info.hpp"
-#include "duckdb/parser/parsed_data/create_scalar_function_info.hpp"
-#include "duckdb/parser/parsed_data/create_table_function_info.hpp"
 #include "duckdb/planner/expression/bound_function_expression.hpp"
 #include "include/icu-current.hpp"
 #include "include/icu-dateadd.hpp"
@@ -25,8 +22,6 @@
 #include "include/icu_extension.hpp"
 #include "unicode/calendar.h"
 #include "unicode/coll.h"
-#include "unicode/errorcode.h"
-#include "unicode/sortkey.h"
 #include "unicode/stringpiece.h"
 #include "unicode/timezone.h"
 #include "unicode/ucol.h"
@@ -209,7 +204,7 @@ static ScalarFunction GetICUCollateFunction(const string &collation, const strin
 	return result;
 }
 
-unique_ptr<icu::TimeZone> GetTimeZoneInternal(string &tz_str, vector<string> &candidates) {
+unique_ptr<icu::TimeZone> GetKnownTimeZone(const string &tz_str) {
 	icu::StringPiece tz_name_utf8(tz_str);
 	const auto uid = icu::UnicodeString::fromUTF8(tz_name_utf8);
 	duckdb::unique_ptr<icu::TimeZone> tz(icu::TimeZone::createTimeZone(uid));
@@ -217,6 +212,66 @@ unique_ptr<icu::TimeZone> GetTimeZoneInternal(string &tz_str, vector<string> &ca
 		return tz;
 	}
 
+	return nullptr;
+}
+
+static string NormalizeTimeZone(const string &tz_str) {
+	if (GetKnownTimeZone(tz_str)) {
+		return tz_str;
+	}
+
+	//	Map UTC±NN00 to Etc/UTC±N
+	do {
+		if (tz_str.size() <= 4) {
+			break;
+		}
+		if (tz_str.compare(0, 3, "UTC")) {
+			break;
+		}
+
+		idx_t pos = 3;
+		const auto sign = tz_str[pos++];
+		if (sign != '+' && sign != '-') {
+			break;
+		}
+
+		string mapped = "Etc/GMT";
+		mapped += sign;
+		const auto base_len = mapped.size();
+		for (; pos < tz_str.size(); ++pos) {
+			const auto digit = tz_str[pos];
+			//	We could get fancy here and count colons and their locations, but I doubt anyone cares.
+			if (digit == '0' || digit == ':') {
+				continue;
+			}
+			if (!StringUtil::CharacterIsDigit(digit)) {
+				break;
+			}
+			mapped += digit;
+		}
+		if (pos < tz_str.size()) {
+			break;
+		}
+		// If we didn't add anything, then make it +0
+		if (mapped.size() == base_len) {
+			mapped.back() = '+';
+			mapped += '0';
+		}
+		// Final sanity check
+		if (GetKnownTimeZone(mapped)) {
+			return mapped;
+		}
+	} while (false);
+
+	return tz_str;
+}
+
+unique_ptr<icu::TimeZone> GetTimeZoneInternal(string &tz_str, vector<string> &candidates) {
+	auto tz = GetKnownTimeZone(tz_str);
+	if (tz) {
+		return tz;
+	}
+
 	// Try to be friendlier
 	// Go through all the zone names and look for a case insensitive match
 	// If we don't find one, make a suggestion
@@ -269,6 +324,7 @@ unique_ptr<icu::TimeZone> ICUHelpers::GetTimeZone(string &tz_str, string *error_
 
 static void SetICUTimeZone(ClientContext &context, SetScope scope, Value &parameter) {
 	auto tz_str = StringValue::Get(parameter);
+	tz_str = NormalizeTimeZone(tz_str);
 	ICUHelpers::GetTimeZone(tz_str);
 	parameter = Value(tz_str);
 }
@@ -405,6 +461,11 @@ static void LoadInternal(ExtensionLoader &loader) {
 	icu::UnicodeString tz_id;
 	std::string tz_string;
 	tz->getID(tz_id).toUTF8String(tz_string);
+	// If the environment TZ is invalid, look for some alternatives
+	tz_string = NormalizeTimeZone(tz_string);
+	if (!GetKnownTimeZone(tz_string)) {
+		tz_string = "UTC";
+	}
 	config.AddExtensionOption("TimeZone", "The current time zone", LogicalType::VARCHAR, Value(tz_string),
 	                          SetICUTimeZone);
 

package/src/duckdb/extension/icu/third_party/icu/common/putil.cpp

@@ -1090,9 +1090,15 @@ uprv_tzname(int n)
         if (tzid[0] == ':') {
             tzid++;
         }
-        /* This might be a good Olson ID. */
-        skipZoneIDPrefix(&tzid);
-        return tzid;
+#if defined(TZDEFAULT)
+        if (uprv_strcmp(tzid, TZDEFAULT) != 0) {
+#endif
+        	/* This might be a good Olson ID. */
+			skipZoneIDPrefix(&tzid);
+			return tzid;
+#if defined(TZDEFAULT)
+		}
+#endif
     }
     /* else U_TZNAME will give a better result. */
 #endif

package/src/duckdb/extension/json/include/json_serializer.hpp

@@ -39,6 +39,18 @@ public:
 		return serializer.GetRootObject();
 	}
 
+	template <class T>
+	static string SerializeToString(T &value) {
+		auto doc = yyjson_mut_doc_new(nullptr);
+		JsonSerializer serializer(doc, false, false, false);
+		value.Serialize(serializer);
+		auto result_obj = serializer.GetRootObject();
+		idx_t len = 0;
+		auto data = yyjson_mut_val_write_opts(result_obj, JSONCommon::WRITE_PRETTY_FLAG, nullptr,
+		                                      reinterpret_cast<size_t *>(&len), nullptr);
+		return string(data, len);
+	}
+
 	yyjson_mut_val *GetRootObject() {
 		D_ASSERT(stack.size() == 1); // or we forgot to pop somewhere
 		return stack.front();

package/src/duckdb/extension/json/json_functions/json_create.cpp

@@ -111,11 +111,11 @@ static unique_ptr<FunctionData> JSONCreateBindParams(ScalarFunction &bound_funct
 		auto &type = arguments[i]->return_type;
 		if (arguments[i]->HasParameter()) {
 			throw ParameterNotResolvedException();
-		} else if (type == LogicalTypeId::SQLNULL) {
-			// This is needed for macro's
-			bound_function.arguments.push_back(type);
 		} else if (object && i % 2 == 0) {
-			// Key, must be varchar
+			if (type != LogicalType::VARCHAR) {
+				throw BinderException("json_object() keys must be VARCHAR, add an explicit cast to argument \"%s\"",
+				                      arguments[i]->GetName());
+			}
 			bound_function.arguments.push_back(LogicalType::VARCHAR);
 		} else {
 			// Value, cast to types that we can put in JSON
@@ -128,7 +128,7 @@ static unique_ptr<FunctionData> JSONCreateBindParams(ScalarFunction &bound_funct
 static unique_ptr<FunctionData> JSONObjectBind(ClientContext &context, ScalarFunction &bound_function,
                                                vector<unique_ptr<Expression>> &arguments) {
 	if (arguments.size() % 2 != 0) {
-		throw InvalidInputException("json_object() requires an even number of arguments");
+		throw BinderException("json_object() requires an even number of arguments");
 	}
 	return JSONCreateBindParams(bound_function, arguments, true);
 }
@@ -141,7 +141,7 @@ static unique_ptr<FunctionData> JSONArrayBind(ClientContext &context, ScalarFunc
 static unique_ptr<FunctionData> ToJSONBind(ClientContext &context, ScalarFunction &bound_function,
                                            vector<unique_ptr<Expression>> &arguments) {
 	if (arguments.size() != 1) {
-		throw InvalidInputException("to_json() takes exactly one argument");
+		throw BinderException("to_json() takes exactly one argument");
 	}
 	return JSONCreateBindParams(bound_function, arguments, false);
 }
@@ -149,14 +149,14 @@ static unique_ptr<FunctionData> ToJSONBind(ClientContext &context, ScalarFunctio
 static unique_ptr<FunctionData> ArrayToJSONBind(ClientContext &context, ScalarFunction &bound_function,
                                                 vector<unique_ptr<Expression>> &arguments) {
 	if (arguments.size() != 1) {
-		throw InvalidInputException("array_to_json() takes exactly one argument");
+		throw BinderException("array_to_json() takes exactly one argument");
 	}
 	auto arg_id = arguments[0]->return_type.id();
 	if (arguments[0]->HasParameter()) {
 		throw ParameterNotResolvedException();
 	}
 	if (arg_id != LogicalTypeId::LIST && arg_id != LogicalTypeId::SQLNULL) {
-		throw InvalidInputException("array_to_json() argument type must be LIST");
+		throw BinderException("array_to_json() argument type must be LIST");
 	}
 	return JSONCreateBindParams(bound_function, arguments, false);
 }
@@ -164,14 +164,14 @@ static unique_ptr<FunctionData> ArrayToJSONBind(ClientContext &context, ScalarFu
 static unique_ptr<FunctionData> RowToJSONBind(ClientContext &context, ScalarFunction &bound_function,
                                               vector<unique_ptr<Expression>> &arguments) {
 	if (arguments.size() != 1) {
-		throw InvalidInputException("row_to_json() takes exactly one argument");
+		throw BinderException("row_to_json() takes exactly one argument");
 	}
 	auto arg_id = arguments[0]->return_type.id();
 	if (arguments[0]->HasParameter()) {
 		throw ParameterNotResolvedException();
 	}
 	if (arguments[0]->return_type.id() != LogicalTypeId::STRUCT && arg_id != LogicalTypeId::SQLNULL) {
-		throw InvalidInputException("row_to_json() argument type must be STRUCT");
+		throw BinderException("row_to_json() argument type must be STRUCT");
 	}
 	return JSONCreateBindParams(bound_function, arguments, false);
 }

package/src/duckdb/extension/parquet/decoder/delta_length_byte_array_decoder.cpp

@@ -34,13 +34,21 @@ void DeltaLengthByteArrayDecoder::InitializePage() {
 void DeltaLengthByteArrayDecoder::Read(shared_ptr<ResizeableBuffer> &block_ref, uint8_t *defines, idx_t read_count,
                                        Vector &result, idx_t result_offset) {
 	if (defines) {
-		ReadInternal<true>(block_ref, defines, read_count, result, result_offset);
+		if (reader.Type().IsJSONType()) {
+			ReadInternal<true, true>(block_ref, defines, read_count, result, result_offset);
+		} else {
+			ReadInternal<true, false>(block_ref, defines, read_count, result, result_offset);
+		}
 	} else {
-		ReadInternal<false>(block_ref, defines, read_count, result, result_offset);
+		if (reader.Type().IsJSONType()) {
+			ReadInternal<false, true>(block_ref, defines, read_count, result, result_offset);
+		} else {
+			ReadInternal<false, false>(block_ref, defines, read_count, result, result_offset);
+		}
 	}
 }
 
-template <bool HAS_DEFINES>
+template <bool HAS_DEFINES, bool VALIDATE_INDIVIDUAL_STRINGS>
 void DeltaLengthByteArrayDecoder::ReadInternal(shared_ptr<ResizeableBuffer> &block_ref, uint8_t *const defines,
                                                const idx_t read_count, Vector &result, const idx_t result_offset) {
 	auto &block = *block_ref;
@@ -58,6 +66,8 @@ void DeltaLengthByteArrayDecoder::ReadInternal(shared_ptr<ResizeableBuffer> &blo
 		}
 	}
 
+	const auto &string_column_reader = reader.Cast<StringColumnReader>();
+
 	const auto start_ptr = block.ptr;
 	for (idx_t row_idx = 0; row_idx < read_count; row_idx++) {
 		const auto result_idx = result_offset + row_idx;
@@ -75,11 +85,15 @@ void DeltaLengthByteArrayDecoder::ReadInternal(shared_ptr<ResizeableBuffer> &blo
 		}
 		const auto &str_len = length_data[length_idx++];
 		result_data[result_idx] = string_t(char_ptr_cast(block.ptr), str_len);
+		if (VALIDATE_INDIVIDUAL_STRINGS) {
+			string_column_reader.VerifyString(char_ptr_cast(block.ptr), str_len);
+		}
 		block.unsafe_inc(str_len);
 	}
 
-	// Verify that the strings we read are valid UTF-8
-	reader.Cast<StringColumnReader>().VerifyString(char_ptr_cast(start_ptr), block.ptr - start_ptr);
+	if (!VALIDATE_INDIVIDUAL_STRINGS) {
+		string_column_reader.VerifyString(char_ptr_cast(start_ptr), NumericCast<uint32_t>(block.ptr - start_ptr));
+	}
 
 	StringColumnReader::ReferenceBlock(result, block_ref);
 }

package/src/duckdb/extension/parquet/include/decoder/delta_length_byte_array_decoder.hpp

@@ -27,7 +27,7 @@ public:
 	void Skip(uint8_t *defines, idx_t skip_count);
 
 private:
-	template <bool HAS_DEFINES>
+	template <bool HAS_DEFINES, bool VALIDATE_INDIVIDUAL_STRINGS>
 	void ReadInternal(shared_ptr<ResizeableBuffer> &block, uint8_t *defines, idx_t read_count, Vector &result,
 	                  idx_t result_offset);
 	template <bool HAS_DEFINES>

package/src/duckdb/extension/parquet/include/parquet_dbp_decoder.hpp

@@ -18,7 +18,7 @@ public:
 	    : buffer_(buffer, buffer_len),
 	      //<block size in values> <number of miniblocks in a block> <total value count> <first value>
 	      block_size_in_values(ParquetDecodeUtils::VarintDecode<uint64_t>(buffer_)),
-	      number_of_miniblocks_per_block(ParquetDecodeUtils::VarintDecode<uint64_t>(buffer_)),
+	      number_of_miniblocks_per_block(DecodeNumberOfMiniblocksPerBlock(buffer_)),
 	      number_of_values_in_a_miniblock(block_size_in_values / number_of_miniblocks_per_block),
 	      total_value_count(ParquetDecodeUtils::VarintDecode<uint64_t>(buffer_)),
 	      previous_value(ParquetDecodeUtils::ZigzagToInt(ParquetDecodeUtils::VarintDecode<uint64_t>(buffer_))),
@@ -31,7 +31,7 @@ public:
 		      number_of_values_in_a_miniblock % BitpackingPrimitives::BITPACKING_ALGORITHM_GROUP_SIZE == 0)) {
 			throw InvalidInputException("Parquet file has invalid block sizes for DELTA_BINARY_PACKED");
 		}
-	};
+	}
 
 	ByteBuffer BufferPtr() const {
 		return buffer_;
@@ -68,6 +68,15 @@ public:
 	}
 
 private:
+	static idx_t DecodeNumberOfMiniblocksPerBlock(ByteBuffer &buffer) {
+		auto res = ParquetDecodeUtils::VarintDecode<uint64_t>(buffer);
+		if (res == 0) {
+			throw InvalidInputException(
+			    "Parquet file has invalid number of miniblocks per block for DELTA_BINARY_PACKED");
+		}
+		return res;
+	}
+
 	template <typename T, bool SKIP_READ = false>
 	void GetBatchInternal(const data_ptr_t target_values_ptr, const idx_t batch_size) {
 		if (batch_size == 0) {

package/src/duckdb/extension/parquet/include/reader/string_column_reader.hpp

@@ -14,6 +14,7 @@
 namespace duckdb {
 
 class StringColumnReader : public ColumnReader {
+public:
 	enum class StringColumnType : uint8_t { VARCHAR, JSON, OTHER };
 
 	static StringColumnType GetStringColumnType(const LogicalType &type) {
@@ -36,7 +37,7 @@ public:
 
 public:
 	static void VerifyString(const char *str_data, uint32_t str_len, const bool isVarchar);
-	void VerifyString(const char *str_data, uint32_t str_len);
+	void VerifyString(const char *str_data, uint32_t str_len) const;
 
 	static void ReferenceBlock(Vector &result, shared_ptr<ResizeableBuffer> &block);
 

package/src/duckdb/extension/parquet/parquet_reader.cpp

@@ -740,7 +740,9 @@ unique_ptr<ParquetColumnSchema> ParquetReader::ParseSchema(ClientContext &contex
 		throw InvalidInputException("Root element of Parquet file must be a struct");
 	}
 	D_ASSERT(next_schema_idx == file_meta_data->schema.size() - 1);
-	D_ASSERT(file_meta_data->row_groups.empty() || next_file_idx == file_meta_data->row_groups[0].columns.size());
+	if (!file_meta_data->row_groups.empty() && next_file_idx != file_meta_data->row_groups[0].columns.size()) {
+		throw InvalidInputException("Parquet reader: row group does not have enough columns");
+	}
 	if (parquet_options.file_row_number) {
 		for (auto &column : root.children) {
 			auto &name = column.name;

package/src/duckdb/extension/parquet/parquet_writer.cpp

@@ -12,6 +12,7 @@
 #include "duckdb/common/serializer/write_stream.hpp"
 #include "duckdb/common/string_util.hpp"
 #include "duckdb/function/table_function.hpp"
+#include "duckdb/main/extension_helper.hpp"
 #include "duckdb/main/client_context.hpp"
 #include "duckdb/main/connection.hpp"
 #include "duckdb/parser/parsed_data/create_copy_function_info.hpp"
@@ -374,6 +375,12 @@ ParquetWriter::ParquetWriter(ClientContext &context, FileSystem &fs, string file
 
 	if (encryption_config) {
 		auto &config = DBConfig::GetConfig(context);
+
+		// To ensure we can write, we need to autoload httpfs
+		if (!config.encryption_util || !config.encryption_util->SupportsEncryption()) {
+			ExtensionHelper::TryAutoLoadExtension(context, "httpfs");
+		}
+
 		if (config.encryption_util && debug_use_openssl) {
 			// Use OpenSSL
 			encryption_util = config.encryption_util;
@@ -562,7 +569,7 @@ void ParquetWriter::FlushRowGroup(PreparedRowGroup &prepared) {
 	row_group.__isset.total_compressed_size = true;
 
 	if (encryption_config) {
-		auto row_group_ordinal = num_row_groups.load();
+		const auto row_group_ordinal = file_meta_data.row_groups.size();
 		if (row_group_ordinal > std::numeric_limits<int16_t>::max()) {
 			throw InvalidInputException("RowGroup ordinal exceeds 32767 when encryption enabled");
 		}
@@ -583,6 +590,14 @@ void ParquetWriter::Flush(ColumnDataCollection &buffer) {
 		return;
 	}
 
+	// "total_written" is only used for the FILE_SIZE_BYTES flag, and only when threads are writing in parallel.
+	// We pre-emptively increase it here to try to reduce overshooting when many threads are writing in parallel.
+	// However, waiting for the exact value (PrepareRowGroup) takes too long, and would cause overshoots to happen.
+	// So, we guess the compression ratio. We guess 3x, but this will be off depending on the data.
+	// "total_written" is restored to the exact number of written bytes at the end of FlushRowGroup.
+	// PhysicalCopyToFile should be reworked to use prepare/flush batch separately for better accuracy.
+	total_written += buffer.SizeInBytes() / 2;
+
 	PreparedRowGroup prepared_row_group;
 	PrepareRowGroup(buffer, prepared_row_group);
 	buffer.Reset();

package/src/duckdb/extension/parquet/reader/string_column_reader.cpp

@@ -31,7 +31,7 @@ void StringColumnReader::VerifyString(const char *str_data, uint32_t str_len, co
 	}
 }
 
-void StringColumnReader::VerifyString(const char *str_data, uint32_t str_len) {
+void StringColumnReader::VerifyString(const char *str_data, uint32_t str_len) const {
 	switch (string_column_type) {
 	case StringColumnType::VARCHAR:
 		VerifyString(str_data, str_len, true);

package/src/duckdb/extension/parquet/writer/primitive_column_writer.cpp

@@ -111,7 +111,7 @@ void PrimitiveColumnWriter::BeginWrite(ColumnWriterState &state_p) {
 		hdr.type = PageType::DATA_PAGE;
 		hdr.__isset.data_page_header = true;
 
-		hdr.data_page_header.num_values = UnsafeNumericCast<int32_t>(page_info.row_count);
+		hdr.data_page_header.num_values = NumericCast<int32_t>(page_info.row_count);
 		hdr.data_page_header.encoding = GetEncoding(state);
 		hdr.data_page_header.definition_level_encoding = Encoding::RLE;
 		hdr.data_page_header.repetition_level_encoding = Encoding::RLE;

package/src/duckdb/src/catalog/default/default_table_functions.cpp

@@ -69,7 +69,7 @@ FROM histogram_values(source, col_name, bin_count := bin_count, technique := tec
 	{DEFAULT_SCHEMA, "duckdb_logs_parsed", {"log_type"}, {}, R"(
 SELECT * EXCLUDE (message), UNNEST(parse_duckdb_log_message(log_type, message))
 FROM duckdb_logs(denormalized_table=1)
-WHERE type = log_type
+WHERE type ILIKE log_type
 )"},
 	{nullptr, nullptr, {nullptr}, {{nullptr, nullptr}}, nullptr}
 	};

package/src/duckdb/src/common/adbc/adbc.cpp

@@ -537,7 +537,8 @@ static int get_schema(struct ArrowArrayStream *stream, struct ArrowSchema *out)
 	auto count = duckdb_column_count(&result_wrapper->result);
 	std::vector<duckdb_logical_type> types(count);
 
-	std::vector<std::string> owned_names(count);
+	std::vector<std::string> owned_names;
+	owned_names.reserve(count);
 	duckdb::vector<const char *> names(count);
 	for (idx_t i = 0; i < count; i++) {
 		types[i] = duckdb_column_logical_type(&result_wrapper->result, i);
@@ -659,12 +660,12 @@ AdbcStatusCode Ingest(duckdb_connection connection, const char *table_name, cons
 		std::ostringstream create_table;
 		create_table << "CREATE TABLE ";
 		if (schema) {
-			create_table << schema << ".";
+			create_table << duckdb::KeywordHelper::WriteOptionallyQuoted(schema) << ".";
 		}
-		create_table << table_name << " (";
+		create_table << duckdb::KeywordHelper::WriteOptionallyQuoted(table_name) << " (";
 		for (idx_t i = 0; i < types.size(); i++) {
-			create_table << names[i] << " ";
-			create_table << types[i].ToString();
+			create_table << duckdb::KeywordHelper::WriteOptionallyQuoted(names[i]);
+			create_table << " " << types[i].ToString();
 			if (i + 1 < types.size()) {
 				create_table << ", ";
 			}
@@ -793,7 +794,8 @@ AdbcStatusCode StatementGetParameterSchema(struct AdbcStatement *statement, stru
 		count = 1;
 	}
 	std::vector<duckdb_logical_type> types(count);
-	std::vector<std::string> owned_names(count);
+	std::vector<std::string> owned_names;
+	owned_names.reserve(count);
 	duckdb::vector<const char *> names(count);
 
 	for (idx_t i = 0; i < count; i++) {

package/src/duckdb/src/common/csv_writer.cpp

@@ -16,7 +16,7 @@ CSVWriterState::CSVWriterState()
 }
 
 CSVWriterState::CSVWriterState(ClientContext &context, idx_t flush_size_p)
-    : flush_size(flush_size_p), stream(make_uniq<MemoryStream>(Allocator::Get(context))) {
+    : flush_size(flush_size_p), stream(make_uniq<MemoryStream>(Allocator::Get(context), flush_size)) {
 }
 
 CSVWriterState::CSVWriterState(DatabaseInstance &db, idx_t flush_size_p)
@@ -198,18 +198,6 @@ void CSVWriter::ResetInternal(optional_ptr<CSVWriterState> local_state) {
 	bytes_written = 0;
 }
 
-unique_ptr<CSVWriterState> CSVWriter::InitializeLocalWriteState(ClientContext &context, idx_t flush_size) {
-	auto res = make_uniq<CSVWriterState>(context, flush_size);
-	res->stream = make_uniq<MemoryStream>();
-	return res;
-}
-
-unique_ptr<CSVWriterState> CSVWriter::InitializeLocalWriteState(DatabaseInstance &db, idx_t flush_size) {
-	auto res = make_uniq<CSVWriterState>(db, flush_size);
-	res->stream = make_uniq<MemoryStream>();
-	return res;
-}
-
 idx_t CSVWriter::BytesWritten() {
 	if (shared) {
 		lock_guard<mutex> flock(lock);

package/src/duckdb/src/common/encryption_key_manager.cpp

@@ -19,7 +19,8 @@ EncryptionKey::EncryptionKey(data_ptr_t encryption_key_p) {
 	D_ASSERT(memcmp(key, encryption_key_p, MainHeader::DEFAULT_ENCRYPTION_KEY_LENGTH) == 0);
 
 	// zero out the encryption key in memory
-	memset(encryption_key_p, 0, MainHeader::DEFAULT_ENCRYPTION_KEY_LENGTH);
+	duckdb_mbedtls::MbedTlsWrapper::AESStateMBEDTLS::SecureClearData(encryption_key_p,
+	                                                                 MainHeader::DEFAULT_ENCRYPTION_KEY_LENGTH);
 	LockEncryptionKey(key);
 }
 
@@ -37,7 +38,7 @@ void EncryptionKey::LockEncryptionKey(data_ptr_t key, idx_t key_len) {
 }
 
 void EncryptionKey::UnlockEncryptionKey(data_ptr_t key, idx_t key_len) {
-	memset(key, 0, key_len);
+	duckdb_mbedtls::MbedTlsWrapper::AESStateMBEDTLS::SecureClearData(key, key_len);
 #if defined(_WIN32)
 	VirtualUnlock(key, key_len);
 #else
@@ -64,7 +65,8 @@ EncryptionKeyManager &EncryptionKeyManager::Get(DatabaseInstance &db) {
 
 string EncryptionKeyManager::GenerateRandomKeyID() {
 	uint8_t key_id[KEY_ID_BYTES];
-	duckdb_mbedtls::MbedTlsWrapper::AESStateMBEDTLS::GenerateRandomDataStatic(key_id, KEY_ID_BYTES);
+	RandomEngine engine;
+	engine.RandomData(key_id, KEY_ID_BYTES);
 	string key_id_str(reinterpret_cast<const char *>(key_id), KEY_ID_BYTES);
 	return key_id_str;
 }
@@ -72,7 +74,7 @@ string EncryptionKeyManager::GenerateRandomKeyID() {
 void EncryptionKeyManager::AddKey(const string &key_name, data_ptr_t key) {
 	derived_keys.emplace(key_name, EncryptionKey(key));
 	// Zero-out the encryption key
-	std::memset(key, 0, DERIVED_KEY_LENGTH);
+	duckdb_mbedtls::MbedTlsWrapper::AESStateMBEDTLS::SecureClearData(key, DERIVED_KEY_LENGTH);
 }
 
 bool EncryptionKeyManager::HasKey(const string &key_name) const {
@@ -107,7 +109,7 @@ string EncryptionKeyManager::Base64Decode(const string &key) {
 	auto output = duckdb::unique_ptr<unsigned char[]>(new unsigned char[result_size]);
 	Blob::FromBase64(key, output.get(), result_size);
 	string decoded_key(reinterpret_cast<const char *>(output.get()), result_size);
-	memset(output.get(), 0, result_size);
+	duckdb_mbedtls::MbedTlsWrapper::AESStateMBEDTLS::SecureClearData(output.get(), result_size);
 	return decoded_key;
 }
 
@@ -124,10 +126,9 @@ void EncryptionKeyManager::DeriveKey(string &user_key, data_ptr_t salt, data_ptr
 
 	KeyDerivationFunctionSHA256(reinterpret_cast<const_data_ptr_t>(decoded_key.data()), decoded_key.size(), salt,
 	                            derived_key);
-
-	// wipe the original and decoded key
-	std::fill(user_key.begin(), user_key.end(), 0);
-	std::fill(decoded_key.begin(), decoded_key.end(), 0);
+	duckdb_mbedtls::MbedTlsWrapper::AESStateMBEDTLS::SecureClearData(data_ptr_cast(&user_key[0]), user_key.size());
+	duckdb_mbedtls::MbedTlsWrapper::AESStateMBEDTLS::SecureClearData(data_ptr_cast(&decoded_key[0]),
+	                                                                 decoded_key.size());
 	user_key.clear();
 	decoded_key.clear();
 }

package/src/duckdb/src/common/enum_util.cpp

@@ -100,6 +100,7 @@
 #include "duckdb/execution/index/art/art_scanner.hpp"
 #include "duckdb/execution/index/art/node.hpp"
 #include "duckdb/execution/index/bound_index.hpp"
+#include "duckdb/execution/index/unbound_index.hpp"
 #include "duckdb/execution/operator/csv_scanner/csv_option.hpp"
 #include "duckdb/execution/operator/csv_scanner/csv_state.hpp"
 #include "duckdb/execution/reservoir_sample.hpp"
@@ -707,6 +708,24 @@ BlockState EnumUtil::FromString<BlockState>(const char *value) {
 	return static_cast<BlockState>(StringUtil::StringToEnum(GetBlockStateValues(), 2, "BlockState", value));
 }
 
+const StringUtil::EnumStringLiteral *GetBufferedIndexReplayValues() {
+	static constexpr StringUtil::EnumStringLiteral values[] {
+		{ static_cast<uint32_t>(BufferedIndexReplay::INSERT_ENTRY), "INSERT_ENTRY" },
+		{ static_cast<uint32_t>(BufferedIndexReplay::DEL_ENTRY), "DEL_ENTRY" }
+	};
+	return values;
+}
+
+template<>
+const char* EnumUtil::ToChars<BufferedIndexReplay>(BufferedIndexReplay value) {
+	return StringUtil::EnumToString(GetBufferedIndexReplayValues(), 2, "BufferedIndexReplay", static_cast<uint32_t>(value));
+}
+
+template<>
+BufferedIndexReplay EnumUtil::FromString<BufferedIndexReplay>(const char *value) {
+	return static_cast<BufferedIndexReplay>(StringUtil::StringToEnum(GetBufferedIndexReplayValues(), 2, "BufferedIndexReplay", value));
+}
+
 const StringUtil::EnumStringLiteral *GetCAPIResultSetTypeValues() {
 	static constexpr StringUtil::EnumStringLiteral values[] {
 		{ static_cast<uint32_t>(CAPIResultSetType::CAPI_RESULT_TYPE_NONE), "CAPI_RESULT_TYPE_NONE" },