chore(deps): bump substrait packages to 0.101.0

[nielspardon]

Closes #253.

Bumps substrait-protobuf, substrait-extensions, and substrait-antlr to spec v0.101.0 (release notes).

• UpdateRel now carries a RelCommon. A correlation into an UpdateRel binding is now anchored by to_id_based_outer_references instead of raising, and DataFrame.hint(...) can annotate an UpdateRel. ReferenceRel is now the only relation without a RelCommon; the converter's no-RelCommon guard is kept for a Rel with no relation set.
• OuterReference.steps_out is deprecated in favour of rel_reference. No change needed: inference already resolves both forms, and the DataFrame layer already emits rel_reference. The lower-level outer() expression builder still produces steps_out, which remains valid.
• extension_types.yaml and type_variations.yaml leave the extension catalog. The default registry only loads functions*.yaml, so nothing here depended on them.

🤖 Generated with AI

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: substrait-io/substrait-python/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 57b0c17e-e479-4de2-bc7e-5ffe3cdf2dcb

📥 Commits

Reviewing files that changed from the base of the PR and between bcfad64 and c777745.

⛔ Files ignored due to path filters (2)

• pixi.lock is excluded by !**/*.lock
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• pyproject.toml
• src/substrait/dataframe/frame.py
• src/substrait/utils/__init__.py
• tests/test_utils.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated Substrait runtime, extensions, and development dependencies to version 0.101.0.
• Documentation
  • Clarified guidance about relation types that may not support hints or common fields.
• Tests
  • Added coverage verifying that correlations into UpdateRel use the relation’s assigned reference anchor.

Walkthrough

Dependency pins are updated to Substrait 0.101.0. Documentation comments and tests now reflect that UpdateRel has RelCommon and can provide an anchor for a relation reference.

Changes

Substrait 0.101.0 update

Layer / File(s)	Summary
Update dependency pins and relation-reference coverage pyproject.toml, src/substrait/dataframe/frame.py, src/substrait/utils/__init__.py, tests/test_utils.py	Dependency pins move to 0.101.0. Comments identify ReferenceRel as lacking RelCommon. Tests retain the missing-RelCommon error case and verify that a correlation into UpdateRel becomes a rel_reference matching its anchor.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: alexandrefimov

Merge Risk: ⚪ Minimal · up to c7777

The dependency update aligns the project with Substrait 0.101.0, and the inspected hint and correlation-reference paths use UpdateRel’s new RelCommon. No actionable merge-blocking issue is evident; proceed with normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to c7777

The inspected changes remain within plan construction and preserve existing guards and failure isolation. No introduced security vulnerability was established, but compatibility with the external generated schema and downstream execution engines remains unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The demonstrated exposure is newly accepted UpdateRel metadata and correlation identities in caller-generated plans. Any resulting data-store authority or tenant reach depends on downstream consumers, which were outside the inspected evidence.

Trust Boundaries and Controls

• inferred — The inspected entrypoints produce protobuf plans, not privileged execution requests. Their metadata and correlation guards enforce representation constraints rather than authorization; downstream enforcement was not established by this review.

Resilience and Maintainability Implications

• inferred — For inspected built-in builders, hint changes affect a freshly materialized result, and conversion failures discard a private copy. Context-local build and anchor scopes are reset on exit, limiting cross-materialization state leakage during failure or concurrent calls; interruption behavior was not exercised.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 3 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise, follows the required Conventional Commit format, and identifies the dependency update to version 0.101.0.
Description check	✅ Passed	The description gives the rationale, lists the package updates, and explains the relevant compatibility changes. It is mostly complete for the repository template.
Linked Issues check	✅ Passed	Issue #253 requests the Substrait v0.101.0 update. pyproject.toml updates substrait-protobuf, substrait-extensions, and substrait-antlr to v0.101.0. The tests cover converting a correlation in…
Out of Scope Changes check	✅ Passed	The dependency updates, UpdateRel documentation and hint guard clarification, and correlation tests all support the v0.101.0 update in issue #253. The supplied change summary shows no unrelated chan…

Full details: Docstring Coverage

Explanation

Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 3 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}