From b2a87c767ecabb1d2f07b89a944cc0a85484aaf2 Mon Sep 17 00:00:00 2001
From: Luiz Irber <luiz@earthmover.io>
Date: Wed, 20 May 2026 15:15:51 -0300
Subject: [PATCH 01/14] bump minimum maturin version

---
 icechunk-python/pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/icechunk-python/pyproject.toml b/icechunk-python/pyproject.toml
index e1acd491b..50dc856a1 100644
--- a/icechunk-python/pyproject.toml
+++ b/icechunk-python/pyproject.toml
@@ -1,5 +1,5 @@
 [build-system]
-requires = ["maturin>=1.7,<2.0"]
+requires = ["maturin>=1.13.1,<2.0"]
 build-backend = "maturin"
 
 [project]

From 4f4a541331eb83bcd6c0f59f6360827362a669ec Mon Sep 17 00:00:00 2001
From: Luiz Irber <luiz@earthmover.io>
Date: Wed, 20 May 2026 15:53:14 -0300
Subject: [PATCH 02/14] v1: Fix wheel building

---
 icechunk-python/Cargo.toml     | 2 +-
 icechunk-python/pyproject.toml | 3 +--
 icechunk/Cargo.toml            | 2 +-
 icechunk/README.md             | 1 +
 4 files changed, 4 insertions(+), 4 deletions(-)
 create mode 120000 icechunk/README.md

diff --git a/icechunk-python/Cargo.toml b/icechunk-python/Cargo.toml
index aed0d50f4..bb4d921b2 100644
--- a/icechunk-python/Cargo.toml
+++ b/icechunk-python/Cargo.toml
@@ -2,7 +2,7 @@
 name = "icechunk-python"
 version = "1.1.21"
 description = "Transactional storage engine for Zarr designed for use on cloud object storage"
-readme = "../README.md"
+readme = "README.md"
 repository = "https://github.com/earth-mover/icechunk"
 homepage = "https://icechunk.io"
 license = "Apache-2.0"
diff --git a/icechunk-python/pyproject.toml b/icechunk-python/pyproject.toml
index 50dc856a1..10933f694 100644
--- a/icechunk-python/pyproject.toml
+++ b/icechunk-python/pyproject.toml
@@ -16,7 +16,7 @@ classifiers = [
   "Programming Language :: Python :: 3.13",
   "Programming Language :: Python :: 3.14",
 ]
-readme = "../README.md"
+readme = "README.md"
 license = { file = "LICENSE" }
 dynamic = ["version"]
 authors = [{ name = "Earthmover", email = "info@earthmover.io" }]
@@ -118,7 +118,6 @@ dev = [
 features = ["pyo3/extension-module"]
 module-name = "icechunk._icechunk_python"
 python-source = "python"
-exclude = ["README.md"]
 
 [tool.uv]
 # Rebuild package when any Rust files change
diff --git a/icechunk/Cargo.toml b/icechunk/Cargo.toml
index 88f1a8ce1..4bc5a608b 100644
--- a/icechunk/Cargo.toml
+++ b/icechunk/Cargo.toml
@@ -2,7 +2,7 @@
 name = "icechunk"
 version = "0.3.24"
 description = "Transactional storage engine for Zarr designed for use on cloud object storage"
-readme = "../README.md"
+readme = "README.md"
 repository = "https://github.com/earth-mover/icechunk"
 homepage = "https://icechunk.io"
 license = "Apache-2.0"
diff --git a/icechunk/README.md b/icechunk/README.md
new file mode 120000
index 000000000..32d46ee88
--- /dev/null
+++ b/icechunk/README.md
@@ -0,0 +1 @@
+../README.md
\ No newline at end of file

From 9520ecf3999085c00a06431594aed05a297e9a0b Mon Sep 17 00:00:00 2001
From: Luiz Irber <luiz@earthmover.io>
Date: Wed, 20 May 2026 16:07:35 -0300
Subject: [PATCH 03/14] pin actions

---
 .github/workflows/code-quality.yaml        |  8 ++--
 .github/workflows/codespell.yml            |  6 +--
 .github/workflows/dependency-check.yaml    |  4 +-
 .github/workflows/publish-rust-library.yml |  4 +-
 .github/workflows/python-check.yaml        | 30 +++++++-------
 .github/workflows/python-ci.yaml           | 46 +++++++++++-----------
 .github/workflows/python-upstream.yaml     | 26 ++++++------
 .github/workflows/rust-ci.yaml             |  4 +-
 .github/workflows/windows-check.yml        |  4 +-
 9 files changed, 66 insertions(+), 66 deletions(-)

diff --git a/.github/workflows/code-quality.yaml b/.github/workflows/code-quality.yaml
index 3159188a7..2910795a8 100644
--- a/.github/workflows/code-quality.yaml
+++ b/.github/workflows/code-quality.yaml
@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -43,7 +43,7 @@ jobs:
           rustup default ${{ env.RUST_CHANNEL }}
 
       - name: Cache Dependencies
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
         with:
           key: ${{ env.RUST_CHANNEL }}
 
@@ -60,7 +60,7 @@ jobs:
           just doctest
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
         with:
           enable-cache: true
 
@@ -71,7 +71,7 @@ jobs:
           uvx --with mypy --with zarr --with hypothesis --with xarray --with dask mypy python
 
       - name: Run pre-commit checks (skip Rust)
-        uses: pre-commit/action@v3.0.1
+        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
         with:
           extra_args: --all-files
         env:
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index 8011a2233..f2af3c9fc 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -18,8 +18,8 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Annotate locations with typos
-        uses: codespell-project/codespell-problem-matcher@v1.2.0
+        uses: codespell-project/codespell-problem-matcher@9ba2c57125d4908eade4308f32c4ff814c184633 # v1.2.0
       - name: Codespell
-        uses: codespell-project/actions-codespell@v2
+        uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 # v2
diff --git a/.github/workflows/dependency-check.yaml b/.github/workflows/dependency-check.yaml
index 13fa6b35a..94e37fd1b 100644
--- a/.github/workflows/dependency-check.yaml
+++ b/.github/workflows/dependency-check.yaml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -42,7 +42,7 @@ jobs:
           rustup default ${{ env.RUST_CHANNEL }}
 
       - name: Cache cargo-deny
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         id: cargo_deny_cache
         with:
           path: ~/.cargo/bin/cargo-deny
diff --git a/.github/workflows/publish-rust-library.yml b/.github/workflows/publish-rust-library.yml
index 8d832f9bf..3673a38fb 100644
--- a/.github/workflows/publish-rust-library.yml
+++ b/.github/workflows/publish-rust-library.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Stand up MinIO
         run: |
           docker compose up -d minio
@@ -44,7 +44,7 @@ jobs:
           rustup default ${{ env.RUST_CHANNEL }}
 
       - name: Cache Dependencies
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
         with:
           # workspaces: "rust -> target"
           key: ${{ env.RUST_CHANNEL }}
diff --git a/.github/workflows/python-check.yaml b/.github/workflows/python-check.yaml
index e82505340..04b54f4dc 100644
--- a/.github/workflows/python-check.yaml
+++ b/.github/workflows/python-check.yaml
@@ -27,13 +27,13 @@ jobs:
   build-wheels:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Build wheels
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@423a6347767a8b16e65c2a7a7042e4a921528da8 # v1
         with:
           working-directory: icechunk-python
           args: --release --out dist --find-interpreter
@@ -42,7 +42,7 @@ jobs:
           CARGO_TERM_QUIET: true
 
       - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
         with:
           name: test-wheels
           path: icechunk-python/dist
@@ -64,20 +64,20 @@ jobs:
             distributed: "latest-release"
             zarr: "latest-release"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Stand up MinIO
         run: |
           docker compose up -d minio
 
       - name: Download wheels
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
         with:
           name: test-wheels
           path: icechunk-python/dist
 
       - name: Restore cached hypothesis directory
         id: restore-hypothesis-cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: icechunk-python/.hypothesis/
           key: cache-hypothesis-${{ runner.os }}-${{ github.run_id }}
@@ -85,7 +85,7 @@ jobs:
             cache-hypothesis-
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
         with:
           enable-cache: true
           python-version: ${{ env.PYTHON_VERSION }}
@@ -135,7 +135,7 @@ jobs:
       - name: Save cached hypothesis directory
         id: save-hypothesis-cache
         if: always()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: icechunk-python/.hypothesis/
           key: cache-hypothesis-${{ runner.os }}-${{ github.run_id }}-${{ matrix.deps-version.name }}
@@ -153,7 +153,7 @@ jobs:
             version: "latest-release"
             zarr: "latest-release"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           path: "icechunk"
 
@@ -163,13 +163,13 @@ jobs:
           docker compose up -d minio
 
       - name: Download wheels
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
         with:
           name: test-wheels
           path: icechunk/icechunk-python/dist
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
         with:
           enable-cache: true
           python-version: ${{ env.PYTHON_VERSION }}
@@ -244,18 +244,18 @@ jobs:
   check-xarray-docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           path: "icechunk"
 
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           repository: "pydata/xarray"
           path: "xarray"
           fetch-depth: 0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
         with:
           enable-cache: true
           python-version: ${{ env.PYTHON_VERSION }}
diff --git a/.github/workflows/python-ci.yaml b/.github/workflows/python-ci.yaml
index 0f45c1b1f..3ce5b01c9 100644
--- a/.github/workflows/python-ci.yaml
+++ b/.github/workflows/python-ci.yaml
@@ -40,7 +40,7 @@ jobs:
     outputs:
       version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           fetch-depth: 0  # Need full history for git describe
 
@@ -92,7 +92,7 @@ jobs:
             target: armv7
             manylinux: 2_28
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Stand up docker services
         run: |
           docker compose up -d
@@ -105,7 +105,7 @@ jobs:
               sleep 3
           done
           docker compose exec -T minio mc alias set minio http://minio:9000 minio123 minio123
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: '3.11'
       - name: Update version in Cargo.toml
@@ -113,14 +113,14 @@ jobs:
         run: |
           sed -i 's/^version = ".*"/version = "${{ needs.version.outputs.version }}"/' Cargo.toml
       - name: Build wheels
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@423a6347767a8b16e65c2a7a7042e4a921528da8 # v1
         with:
           working-directory: icechunk-python
           target: ${{ matrix.platform.target }}
           args: --release --out dist --find-interpreter
           manylinux: ${{ matrix.platform.manylinux }} # https://github.com/PyO3/maturin-action/issues/245
       - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
         with:
           name: wheels-linux-${{ matrix.platform.target }}
           path: icechunk-python/dist
@@ -140,8 +140,8 @@ jobs:
           - runner: ubuntu-latest
             target: armv7
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: 3.x
       - name: Update version in Cargo.toml
@@ -149,14 +149,14 @@ jobs:
         run: |
           sed -i 's/^version = ".*"/version = "${{ needs.version.outputs.version }}"/' Cargo.toml
       - name: Build wheels
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@423a6347767a8b16e65c2a7a7042e4a921528da8 # v1
         with:
           working-directory: icechunk-python
           target: ${{ matrix.platform.target }}
           args: --release --out dist --find-interpreter
           manylinux: musllinux_1_2
       - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
         with:
           name: wheels-musllinux-${{ matrix.platform.target }}
           path: icechunk-python/dist
@@ -170,8 +170,8 @@ jobs:
           - runner: windows-latest
             target: x64
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: 3.x
           architecture: ${{ matrix.platform.target }}
@@ -181,13 +181,13 @@ jobs:
           (Get-Content Cargo.toml) -replace '^version = ".*"', 'version = "${{ needs.version.outputs.version }}"' | Set-Content Cargo.toml
         shell: powershell
       - name: Build wheels
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@423a6347767a8b16e65c2a7a7042e4a921528da8 # v1
         with:
           working-directory: icechunk-python
           target: ${{ matrix.platform.target }}
           args: --release --out dist --find-interpreter
       - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
         with:
           name: wheels-windows-${{ matrix.platform.target }}
           path: icechunk-python/dist
@@ -203,8 +203,8 @@ jobs:
           - runner: macos-14
             target: aarch64
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: 3.x
       - name: Update version in Cargo.toml
@@ -212,13 +212,13 @@ jobs:
         run: |
           sed -i '' 's/^version = ".*"/version = "${{ needs.version.outputs.version }}"/' Cargo.toml
       - name: Build wheels
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@423a6347767a8b16e65c2a7a7042e4a921528da8 # v1
         with:
           working-directory: icechunk-python
           target: ${{ matrix.platform.target }}
           args: --release --out dist --find-interpreter
       - name: Upload wheels
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
         with:
           name: wheels-macos-${{ matrix.platform.target }}
           path: icechunk-python/dist
@@ -227,19 +227,19 @@ jobs:
     runs-on: ubuntu-latest
     needs: version
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Update version in Cargo.toml
         if: ${{ github.event_name == 'schedule' || inputs.use_git_version == true }}
         run: |
           sed -i 's/^version = ".*"/version = "${{ needs.version.outputs.version }}"/' Cargo.toml
       - name: Build sdist
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@423a6347767a8b16e65c2a7a7042e4a921528da8 # v1
         with:
           working-directory: icechunk-python
           command: sdist
           args: --out dist
       - name: Upload sdist
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
         with:
           name: wheels-sdist
           path: icechunk-python/dist
@@ -252,9 +252,9 @@ jobs:
     if: ${{ github.event_name == 'workflow_dispatch' && inputs.pypi_release }}
     needs: [linux, musllinux, windows, macos, sdist]
     steps:
-      - uses: actions/download-artifact@v6
+      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
       - name: Publish to PyPI
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@423a6347767a8b16e65c2a7a7042e4a921528da8 # v1
         with:
           command: upload
           args: --non-interactive --skip-existing wheels-*/*
@@ -265,7 +265,7 @@ jobs:
     if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
     needs: [linux, musllinux, windows, macos, sdist]
     steps:
-      - uses: actions/download-artifact@v6
+      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
         with:
           path: dist
           merge-multiple: true
diff --git a/.github/workflows/python-upstream.yaml b/.github/workflows/python-upstream.yaml
index 4499450de..ba8aee4eb 100644
--- a/.github/workflows/python-upstream.yaml
+++ b/.github/workflows/python-upstream.yaml
@@ -37,7 +37,7 @@ jobs:
       || github.event_name == 'schedule'
       }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Install Just
         run: sudo snap install --edge --classic just
       - name: Stand up MinIO
@@ -53,17 +53,17 @@ jobs:
               sleep 3
           done
           docker compose exec -T minio mc alias set minio http://minio:9000 minio123 minio123
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Build wheels
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@423a6347767a8b16e65c2a7a7042e4a921528da8 # v1
         with:
           working-directory: icechunk-python
           # target: ${{ matrix.platform.target }}
@@ -141,7 +141,7 @@ jobs:
       - name: Restore cached hypothesis directory
         id: restore-hypothesis-cache
         if: always()
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: icechunk-python/.hypothesis/
           key: cache-hypothesis-${{ runner.os }}-${{ github.run_id }}
@@ -173,7 +173,7 @@ jobs:
       - name: Save cached hypothesis directory
         id: save-hypothesis-cache
         if: always()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: icechunk-python/.hypothesis/
           key: cache-hypothesis-${{ runner.os }}-${{ github.run_id }}
@@ -184,7 +184,7 @@ jobs:
           && steps.pytest-icechunk.outcome == 'failure'
           && github.event_name == 'schedule'
           && github.repository_owner == 'earth-mover'
-        uses: xarray-contrib/issue-from-pytest-log@v1
+        uses: xarray-contrib/issue-from-pytest-log@8e905db353437cda1d6a773de245343fbfc940dd # v1
         with:
           log-path: icechunk-python/output-pytest-log.jsonl
 
@@ -197,27 +197,27 @@ jobs:
       || github.event_name == 'schedule'
       }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           path: "icechunk"
 
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           repository: "pydata/xarray"
           path: "xarray"
           fetch-depth: 0 # Fetch all history for all branches and tags.
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Build wheels
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@423a6347767a8b16e65c2a7a7042e4a921528da8 # v1
         with:
           working-directory: icechunk/icechunk-python
           args: --release --out dist --find-interpreter
@@ -270,7 +270,7 @@ jobs:
           && steps.pytest-xarray-backends.outcome == 'failure'
           && github.event_name == 'schedule'
           && github.repository_owner == 'earth-mover'
-        uses: xarray-contrib/issue-from-pytest-log@v1
+        uses: xarray-contrib/issue-from-pytest-log@8e905db353437cda1d6a773de245343fbfc940dd # v1
         with:
           log-path: icechunk/icechunk-python/output-pytest-log.jsonl
           issue-title: "Nightly Xarray backends tests failed"
diff --git a/.github/workflows/rust-ci.yaml b/.github/workflows/rust-ci.yaml
index 62b48b928..1cbd034f2 100644
--- a/.github/workflows/rust-ci.yaml
+++ b/.github/workflows/rust-ci.yaml
@@ -46,7 +46,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -83,7 +83,7 @@ jobs:
           rustup default ${{ env.RUST_CHANNEL }}
 
       - name: Cache Dependencies
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
         with:
           # workspaces: "rust -> target"
           key: ${{ env.RUST_CHANNEL }}
diff --git a/.github/workflows/windows-check.yml b/.github/workflows/windows-check.yml
index b86e636c8..85806e79d 100644
--- a/.github/workflows/windows-check.yml
+++ b/.github/workflows/windows-check.yml
@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -45,7 +45,7 @@ jobs:
           rustup default ${{ env.RUST_CHANNEL }}
 
       - name: Cache Dependencies
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
         with:
           # workspaces: "rust -> target"
           key: windows-${{ env.RUST_CHANNEL }}

From 7ad1fd259d3ecd6506856adcf8110de58bc681ef Mon Sep 17 00:00:00 2001
From: Luiz Irber <luiz@earthmover.io>
Date: Wed, 20 May 2026 16:39:04 -0300
Subject: [PATCH 04/14] disable warnings for mkdocs 2

---
 .readthedocs.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.readthedocs.yaml b/.readthedocs.yaml
index 8957a756c..6fe1e06e5 100644
--- a/.readthedocs.yaml
+++ b/.readthedocs.yaml
@@ -11,6 +11,9 @@ build:
       - cd icechunk-python && maturin build && pip install "$(ls ../target/wheels/*.whl | head -n 1)" && pip install --group docs
       - mamba list
       - cd docs
+    build:
+      html:
+        - DISABLE_MKDOCS_2_WARNING=true mkdocs build --site-dir $READTHEDOCS_OUTPUT/html
 
 conda:
   environment: docs/doc-env.yml

From 39d1091b88af08782d8d839bcdf4c4f071d06562 Mon Sep 17 00:00:00 2001
From: Luiz Irber <luiz@earthmover.io>
Date: Wed, 20 May 2026 16:43:59 -0300
Subject: [PATCH 05/14] sync actions SHA with main

---
 .github/workflows/code-quality.yaml        |  4 +--
 .github/workflows/codespell.yml            |  4 +--
 .github/workflows/dependency-check.yaml    |  4 +--
 .github/workflows/publish-rust-library.yml |  4 +--
 .github/workflows/python-check.yaml        | 22 ++++++------
 .github/workflows/python-ci.yaml           | 40 +++++++++++-----------
 .github/workflows/python-upstream.yaml     | 14 ++++----
 .github/workflows/rust-ci.yaml             |  4 +--
 .github/workflows/windows-check.yml        |  4 +--
 9 files changed, 50 insertions(+), 50 deletions(-)

diff --git a/.github/workflows/code-quality.yaml b/.github/workflows/code-quality.yaml
index 2910795a8..9eff3b526 100644
--- a/.github/workflows/code-quality.yaml
+++ b/.github/workflows/code-quality.yaml
@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -43,7 +43,7 @@ jobs:
           rustup default ${{ env.RUST_CHANNEL }}
 
       - name: Cache Dependencies
-        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           key: ${{ env.RUST_CHANNEL }}
 
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index f2af3c9fc..d306df3e2 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -18,8 +18,8 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Annotate locations with typos
         uses: codespell-project/codespell-problem-matcher@9ba2c57125d4908eade4308f32c4ff814c184633 # v1.2.0
       - name: Codespell
-        uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 # v2
+        uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579 # v2.2
diff --git a/.github/workflows/dependency-check.yaml b/.github/workflows/dependency-check.yaml
index 94e37fd1b..f9b689c5d 100644
--- a/.github/workflows/dependency-check.yaml
+++ b/.github/workflows/dependency-check.yaml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -42,7 +42,7 @@ jobs:
           rustup default ${{ env.RUST_CHANNEL }}
 
       - name: Cache cargo-deny
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         id: cargo_deny_cache
         with:
           path: ~/.cargo/bin/cargo-deny
diff --git a/.github/workflows/publish-rust-library.yml b/.github/workflows/publish-rust-library.yml
index 3673a38fb..1dbb29f6e 100644
--- a/.github/workflows/publish-rust-library.yml
+++ b/.github/workflows/publish-rust-library.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Stand up MinIO
         run: |
           docker compose up -d minio
@@ -44,7 +44,7 @@ jobs:
           rustup default ${{ env.RUST_CHANNEL }}
 
       - name: Cache Dependencies
-        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           # workspaces: "rust -> target"
           key: ${{ env.RUST_CHANNEL }}
diff --git a/.github/workflows/python-check.yaml b/.github/workflows/python-check.yaml
index 04b54f4dc..09bce4dee 100644
--- a/.github/workflows/python-check.yaml
+++ b/.github/workflows/python-check.yaml
@@ -27,13 +27,13 @@ jobs:
   build-wheels:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Build wheels
-        uses: PyO3/maturin-action@423a6347767a8b16e65c2a7a7042e4a921528da8 # v1
+        uses: PyO3/maturin-action@db323e2cf5679b7feb8bcb561a36b27a0bc19e79 # v1
         with:
           working-directory: icechunk-python
           args: --release --out dist --find-interpreter
@@ -42,7 +42,7 @@ jobs:
           CARGO_TERM_QUIET: true
 
       - name: Upload wheels
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: test-wheels
           path: icechunk-python/dist
@@ -64,20 +64,20 @@ jobs:
             distributed: "latest-release"
             zarr: "latest-release"
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Stand up MinIO
         run: |
           docker compose up -d minio
 
       - name: Download wheels
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: test-wheels
           path: icechunk-python/dist
 
       - name: Restore cached hypothesis directory
         id: restore-hypothesis-cache
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: icechunk-python/.hypothesis/
           key: cache-hypothesis-${{ runner.os }}-${{ github.run_id }}
@@ -135,7 +135,7 @@ jobs:
       - name: Save cached hypothesis directory
         id: save-hypothesis-cache
         if: always()
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: icechunk-python/.hypothesis/
           key: cache-hypothesis-${{ runner.os }}-${{ github.run_id }}-${{ matrix.deps-version.name }}
@@ -153,7 +153,7 @@ jobs:
             version: "latest-release"
             zarr: "latest-release"
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           path: "icechunk"
 
@@ -163,7 +163,7 @@ jobs:
           docker compose up -d minio
 
       - name: Download wheels
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: test-wheels
           path: icechunk/icechunk-python/dist
@@ -244,11 +244,11 @@ jobs:
   check-xarray-docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           path: "icechunk"
 
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           repository: "pydata/xarray"
           path: "xarray"
diff --git a/.github/workflows/python-ci.yaml b/.github/workflows/python-ci.yaml
index 3ce5b01c9..1a8b3c1db 100644
--- a/.github/workflows/python-ci.yaml
+++ b/.github/workflows/python-ci.yaml
@@ -40,7 +40,7 @@ jobs:
     outputs:
       version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0  # Need full history for git describe
 
@@ -92,7 +92,7 @@ jobs:
             target: armv7
             manylinux: 2_28
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Stand up docker services
         run: |
           docker compose up -d
@@ -113,14 +113,14 @@ jobs:
         run: |
           sed -i 's/^version = ".*"/version = "${{ needs.version.outputs.version }}"/' Cargo.toml
       - name: Build wheels
-        uses: PyO3/maturin-action@423a6347767a8b16e65c2a7a7042e4a921528da8 # v1
+        uses: PyO3/maturin-action@db323e2cf5679b7feb8bcb561a36b27a0bc19e79 # v1
         with:
           working-directory: icechunk-python
           target: ${{ matrix.platform.target }}
           args: --release --out dist --find-interpreter
           manylinux: ${{ matrix.platform.manylinux }} # https://github.com/PyO3/maturin-action/issues/245
       - name: Upload wheels
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: wheels-linux-${{ matrix.platform.target }}
           path: icechunk-python/dist
@@ -140,7 +140,7 @@ jobs:
           - runner: ubuntu-latest
             target: armv7
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: 3.x
@@ -149,14 +149,14 @@ jobs:
         run: |
           sed -i 's/^version = ".*"/version = "${{ needs.version.outputs.version }}"/' Cargo.toml
       - name: Build wheels
-        uses: PyO3/maturin-action@423a6347767a8b16e65c2a7a7042e4a921528da8 # v1
+        uses: PyO3/maturin-action@db323e2cf5679b7feb8bcb561a36b27a0bc19e79 # v1
         with:
           working-directory: icechunk-python
           target: ${{ matrix.platform.target }}
           args: --release --out dist --find-interpreter
           manylinux: musllinux_1_2
       - name: Upload wheels
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: wheels-musllinux-${{ matrix.platform.target }}
           path: icechunk-python/dist
@@ -170,7 +170,7 @@ jobs:
           - runner: windows-latest
             target: x64
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: 3.x
@@ -181,13 +181,13 @@ jobs:
           (Get-Content Cargo.toml) -replace '^version = ".*"', 'version = "${{ needs.version.outputs.version }}"' | Set-Content Cargo.toml
         shell: powershell
       - name: Build wheels
-        uses: PyO3/maturin-action@423a6347767a8b16e65c2a7a7042e4a921528da8 # v1
+        uses: PyO3/maturin-action@db323e2cf5679b7feb8bcb561a36b27a0bc19e79 # v1
         with:
           working-directory: icechunk-python
           target: ${{ matrix.platform.target }}
           args: --release --out dist --find-interpreter
       - name: Upload wheels
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: wheels-windows-${{ matrix.platform.target }}
           path: icechunk-python/dist
@@ -203,7 +203,7 @@ jobs:
           - runner: macos-14
             target: aarch64
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: 3.x
@@ -212,13 +212,13 @@ jobs:
         run: |
           sed -i '' 's/^version = ".*"/version = "${{ needs.version.outputs.version }}"/' Cargo.toml
       - name: Build wheels
-        uses: PyO3/maturin-action@423a6347767a8b16e65c2a7a7042e4a921528da8 # v1
+        uses: PyO3/maturin-action@db323e2cf5679b7feb8bcb561a36b27a0bc19e79 # v1
         with:
           working-directory: icechunk-python
           target: ${{ matrix.platform.target }}
           args: --release --out dist --find-interpreter
       - name: Upload wheels
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: wheels-macos-${{ matrix.platform.target }}
           path: icechunk-python/dist
@@ -227,19 +227,19 @@ jobs:
     runs-on: ubuntu-latest
     needs: version
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Update version in Cargo.toml
         if: ${{ github.event_name == 'schedule' || inputs.use_git_version == true }}
         run: |
           sed -i 's/^version = ".*"/version = "${{ needs.version.outputs.version }}"/' Cargo.toml
       - name: Build sdist
-        uses: PyO3/maturin-action@423a6347767a8b16e65c2a7a7042e4a921528da8 # v1
+        uses: PyO3/maturin-action@db323e2cf5679b7feb8bcb561a36b27a0bc19e79 # v1
         with:
           working-directory: icechunk-python
           command: sdist
           args: --out dist
       - name: Upload sdist
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: wheels-sdist
           path: icechunk-python/dist
@@ -252,9 +252,9 @@ jobs:
     if: ${{ github.event_name == 'workflow_dispatch' && inputs.pypi_release }}
     needs: [linux, musllinux, windows, macos, sdist]
     steps:
-      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
       - name: Publish to PyPI
-        uses: PyO3/maturin-action@423a6347767a8b16e65c2a7a7042e4a921528da8 # v1
+        uses: PyO3/maturin-action@db323e2cf5679b7feb8bcb561a36b27a0bc19e79 # v1
         with:
           command: upload
           args: --non-interactive --skip-existing wheels-*/*
@@ -265,13 +265,13 @@ jobs:
     if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
     needs: [linux, musllinux, windows, macos, sdist]
     steps:
-      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           path: dist
           merge-multiple: true
 
       - name: Upload nightly wheels
-        uses: scientific-python/upload-nightly-action@b36e8c0c10dbcfd2e05bf95f17ef8c14fd708dbf
+        uses: scientific-python/upload-nightly-action@e76cfec8a4611fd02808a801b0ff5a7d7c1b2d99
         with:
           artifacts_path: dist
           anaconda_nightly_upload_token: ${{ secrets.ANACONDA_ORG_UPLOAD_TOKEN }}
diff --git a/.github/workflows/python-upstream.yaml b/.github/workflows/python-upstream.yaml
index ba8aee4eb..09cbf6e0e 100644
--- a/.github/workflows/python-upstream.yaml
+++ b/.github/workflows/python-upstream.yaml
@@ -37,7 +37,7 @@ jobs:
       || github.event_name == 'schedule'
       }}
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Install Just
         run: sudo snap install --edge --classic just
       - name: Stand up MinIO
@@ -63,7 +63,7 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Build wheels
-        uses: PyO3/maturin-action@423a6347767a8b16e65c2a7a7042e4a921528da8 # v1
+        uses: PyO3/maturin-action@db323e2cf5679b7feb8bcb561a36b27a0bc19e79 # v1
         with:
           working-directory: icechunk-python
           # target: ${{ matrix.platform.target }}
@@ -141,7 +141,7 @@ jobs:
       - name: Restore cached hypothesis directory
         id: restore-hypothesis-cache
         if: always()
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: icechunk-python/.hypothesis/
           key: cache-hypothesis-${{ runner.os }}-${{ github.run_id }}
@@ -173,7 +173,7 @@ jobs:
       - name: Save cached hypothesis directory
         id: save-hypothesis-cache
         if: always()
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: icechunk-python/.hypothesis/
           key: cache-hypothesis-${{ runner.os }}-${{ github.run_id }}
@@ -197,11 +197,11 @@ jobs:
       || github.event_name == 'schedule'
       }}
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           path: "icechunk"
 
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           repository: "pydata/xarray"
           path: "xarray"
@@ -217,7 +217,7 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Build wheels
-        uses: PyO3/maturin-action@423a6347767a8b16e65c2a7a7042e4a921528da8 # v1
+        uses: PyO3/maturin-action@db323e2cf5679b7feb8bcb561a36b27a0bc19e79 # v1
         with:
           working-directory: icechunk/icechunk-python
           args: --release --out dist --find-interpreter
diff --git a/.github/workflows/rust-ci.yaml b/.github/workflows/rust-ci.yaml
index 1cbd034f2..17e0276a6 100644
--- a/.github/workflows/rust-ci.yaml
+++ b/.github/workflows/rust-ci.yaml
@@ -46,7 +46,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -83,7 +83,7 @@ jobs:
           rustup default ${{ env.RUST_CHANNEL }}
 
       - name: Cache Dependencies
-        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           # workspaces: "rust -> target"
           key: ${{ env.RUST_CHANNEL }}
diff --git a/.github/workflows/windows-check.yml b/.github/workflows/windows-check.yml
index 85806e79d..9d8ed2690 100644
--- a/.github/workflows/windows-check.yml
+++ b/.github/workflows/windows-check.yml
@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -45,7 +45,7 @@ jobs:
           rustup default ${{ env.RUST_CHANNEL }}
 
       - name: Cache Dependencies
-        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           # workspaces: "rust -> target"
           key: windows-${{ env.RUST_CHANNEL }}

From 52ea4aaeb73e26add2fbc53c775b7a8f50c48b7a Mon Sep 17 00:00:00 2001
From: Luiz Irber <luiz@earthmover.io>
Date: Wed, 20 May 2026 17:00:57 -0300
Subject: [PATCH 06/14] avoid pre-commit action, not maintained anymore

---
 .github/workflows/code-quality.yaml | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/code-quality.yaml b/.github/workflows/code-quality.yaml
index 9eff3b526..67950ada3 100644
--- a/.github/workflows/code-quality.yaml
+++ b/.github/workflows/code-quality.yaml
@@ -71,8 +71,6 @@ jobs:
           uvx --with mypy --with zarr --with hypothesis --with xarray --with dask mypy python
 
       - name: Run pre-commit checks (skip Rust)
-        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
-        with:
-          extra_args: --all-files
-        env:
-          SKIP: rust-pre-commit-fast,rust-pre-commit,rust-pre-commit-ci
+        shell: bash
+        run: |
+          SKIP="rust-pre-commit-fast,rust-pre-commit,rust-pre-commit-ci" uvx prek==0.4.1 run --all-files

From fbab40c9cf6c37b339902e6584d437a0077e82df Mon Sep 17 00:00:00 2001
From: Luiz Irber <luiz@earthmover.io>
Date: Wed, 20 May 2026 17:02:06 -0300
Subject: [PATCH 07/14] fix typo

---
 icechunk/src/asset_manager.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/icechunk/src/asset_manager.rs b/icechunk/src/asset_manager.rs
index baac9f793..bac528d09 100644
--- a/icechunk/src/asset_manager.rs
+++ b/icechunk/src/asset_manager.rs
@@ -882,7 +882,7 @@ mod test {
             vec![("fetch_manifest_splitting".to_string(), pre_existing_id.to_string())]
         );
 
-        // other walues still cached
+        // other values still cached
         caching.fetch_manifest(&id, size).await?;
         assert_eq!(
             logging.fetch_operations(),

From e2eae0c21bea8d7f4dc79b829a5bdb6de84ce008 Mon Sep 17 00:00:00 2001
From: Luiz Irber <luiz@earthmover.io>
Date: Wed, 20 May 2026 17:11:46 -0300
Subject: [PATCH 08/14] update rust deps and advisories based on main

---
 Cargo.lock | 203 ++++++++++++++++++++++++++++++-----------------------
 deny.toml  |   8 +++
 2 files changed, 124 insertions(+), 87 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 44eff2527..c8782b6e7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -183,9 +183,9 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
 [[package]]
 name = "aws-config"
-version = "1.8.12"
+version = "1.8.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96571e6996817bf3d58f6b569e4b9fd2e9d2fcf9f7424eed07b2ce9bb87535e5"
+checksum = "c456581cb3c77fafcc8c67204a70680d40b61112d6da78c77bd31d945b65f1b5"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
@@ -193,8 +193,8 @@ dependencies = [
  "aws-sdk-ssooidc",
  "aws-sdk-sts",
  "aws-smithy-async",
- "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-http 0.63.4",
+ "aws-smithy-json 0.62.4",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -225,9 +225,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.15.1"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b5ce75405893cd713f9ab8e297d8e438f624dde7d706108285f7e17a25a180f"
+checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00"
 dependencies = [
  "aws-lc-sys",
  "zeroize",
@@ -235,9 +235,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.34.0"
+version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "179c3777a8b5e70e90ea426114ffc565b2c1a9f82f6c4a0c5a34aa6ef5e781b6"
+checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4"
 dependencies = [
  "cc",
  "cmake",
@@ -247,15 +247,15 @@ dependencies = [
 
 [[package]]
 name = "aws-runtime"
-version = "1.5.18"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "959dab27ce613e6c9658eb3621064d0e2027e5f2acb65bc526a43577facea557"
+checksum = "c635c2dc792cb4a11ce1a4f392a925340d1bdf499289b5ec1ec6810954eb43f5"
 dependencies = [
  "aws-credential-types",
  "aws-sigv4",
  "aws-smithy-async",
  "aws-smithy-eventstream",
- "aws-smithy-http",
+ "aws-smithy-http 0.63.4",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -263,7 +263,9 @@ dependencies = [
  "bytes",
  "fastrand",
  "http 0.2.12",
+ "http 1.4.0",
  "http-body 0.4.6",
+ "http-body 1.0.1",
  "percent-encoding",
  "pin-project-lite",
  "tracing",
@@ -282,8 +284,8 @@ dependencies = [
  "aws-smithy-async",
  "aws-smithy-checksums",
  "aws-smithy-eventstream",
- "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-http 0.62.6",
+ "aws-smithy-json 0.61.9",
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
@@ -307,15 +309,16 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-sso"
-version = "1.91.0"
+version = "1.93.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ee6402a36f27b52fe67661c6732d684b2635152b676aa2babbfb5204f99115d"
+checksum = "9dcb38bb33fc0a11f1ffc3e3e85669e0a11a37690b86f77e75306d8f369146a0"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
- "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-http 0.63.4",
+ "aws-smithy-json 0.62.4",
+ "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -323,21 +326,23 @@ dependencies = [
  "bytes",
  "fastrand",
  "http 0.2.12",
+ "http 1.4.0",
  "regex-lite",
  "tracing",
 ]
 
 [[package]]
 name = "aws-sdk-ssooidc"
-version = "1.93.0"
+version = "1.95.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a45a7f750bbd170ee3677671ad782d90b894548f4e4ae168302c57ec9de5cb3e"
+checksum = "2ada8ffbea7bd1be1f53df1dadb0f8fdb04badb13185b3321b929d1ee3caad09"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
- "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-http 0.63.4",
+ "aws-smithy-json 0.62.4",
+ "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -345,21 +350,23 @@ dependencies = [
  "bytes",
  "fastrand",
  "http 0.2.12",
+ "http 1.4.0",
  "regex-lite",
  "tracing",
 ]
 
 [[package]]
 name = "aws-sdk-sts"
-version = "1.95.0"
+version = "1.97.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55542378e419558e6b1f398ca70adb0b2088077e79ad9f14eb09441f2f7b2164"
+checksum = "e6443ccadc777095d5ed13e21f5c364878c9f5bad4e35187a6cdbd863b0afcad"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
- "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-http 0.63.4",
+ "aws-smithy-json 0.62.4",
+ "aws-smithy-observability",
  "aws-smithy-query",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
@@ -368,19 +375,20 @@ dependencies = [
  "aws-types",
  "fastrand",
  "http 0.2.12",
+ "http 1.4.0",
  "regex-lite",
  "tracing",
 ]
 
 [[package]]
 name = "aws-sigv4"
-version = "1.3.7"
+version = "1.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69e523e1c4e8e7e8ff219d732988e22bfeae8a1cafdbe6d9eca1546fa080be7c"
+checksum = "efa49f3c607b92daae0c078d48a4571f599f966dce3caee5f1ea55c4d9073f99"
 dependencies = [
  "aws-credential-types",
  "aws-smithy-eventstream",
- "aws-smithy-http",
+ "aws-smithy-http 0.63.4",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "bytes",
@@ -402,9 +410,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-async"
-version = "1.2.7"
+version = "1.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ee19095c7c4dda59f1697d028ce704c24b2d33c6718790c7f1d5a3015b4107c"
+checksum = "2ffcaf626bdda484571968400c326a244598634dc75fd451325a54ad1a59acfc"
 dependencies = [
  "futures-util",
  "pin-project-lite",
@@ -417,7 +425,7 @@ version = "0.63.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "23374b9170cbbcc6f5df8dc5ebb9b6c5c28a3c8f599f0e8b8b10eb6f4a5c6e74"
 dependencies = [
- "aws-smithy-http",
+ "aws-smithy-http 0.62.6",
  "aws-smithy-types",
  "bytes",
  "crc-fast",
@@ -433,9 +441,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-eventstream"
-version = "0.60.14"
+version = "0.60.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc12f8b310e38cad85cf3bef45ad236f470717393c613266ce0a89512286b650"
+checksum = "1c0b3e587fbaa5d7f7e870544508af8ce82ea47cd30376e69e1e37c4ac746f79"
 dependencies = [
  "aws-smithy-types",
  "bytes",
@@ -464,11 +472,32 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "aws-smithy-http"
+version = "0.63.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af4a8a5fe3e4ac7ee871237c340bbce13e982d37543b65700f4419e039f5d78e"
+dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "bytes",
+ "bytes-utils",
+ "futures-core",
+ "futures-util",
+ "http 1.4.0",
+ "http-body 1.0.1",
+ "http-body-util",
+ "percent-encoding",
+ "pin-project-lite",
+ "pin-utils",
+ "tracing",
+]
+
 [[package]]
 name = "aws-smithy-http-client"
-version = "1.1.5"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59e62db736db19c488966c8d787f52e6270be565727236fd5579eaa301e7bc4a"
+checksum = "0709f0083aa19b704132684bc26d3c868e06bd428ccc4373b0b55c3e8748a58b"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
@@ -485,7 +514,7 @@ dependencies = [
  "hyper-util",
  "pin-project-lite",
  "rustls 0.21.12",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-native-certs",
  "rustls-pki-types",
  "tokio",
@@ -503,20 +532,29 @@ dependencies = [
  "aws-smithy-types",
 ]
 
+[[package]]
+name = "aws-smithy-json"
+version = "0.62.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b3a779093e18cad88bbae08dc4261e1d95018c4c5b9356a52bcae7c0b6e9bb"
+dependencies = [
+ "aws-smithy-types",
+]
+
 [[package]]
 name = "aws-smithy-observability"
-version = "0.2.0"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef1fcbefc7ece1d70dcce29e490f269695dfca2d2bacdeaf9e5c3f799e4e6a42"
+checksum = "4d3f39d5bb871aaf461d59144557f16d5927a5248a983a40654d9cf3b9ba183b"
 dependencies = [
  "aws-smithy-runtime-api",
 ]
 
 [[package]]
 name = "aws-smithy-query"
-version = "0.60.9"
+version = "0.60.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae5d689cf437eae90460e944a58b5668530d433b4ff85789e69d2f2a556e057d"
+checksum = "05f76a580e3d8f8961e5d48763214025a2af65c2fa4cd1fb7f270a0e107a71b0"
 dependencies = [
  "aws-smithy-types",
  "urlencoding",
@@ -524,12 +562,12 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime"
-version = "1.9.8"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb5b6167fcdf47399024e81ac08e795180c576a20e4d4ce67949f9a88ae37dc1"
+checksum = "8fd3dfc18c1ce097cf81fced7192731e63809829c6cbf933c1ec47452d08e1aa"
 dependencies = [
  "aws-smithy-async",
- "aws-smithy-http",
+ "aws-smithy-http 0.63.4",
  "aws-smithy-http-client",
  "aws-smithy-observability",
  "aws-smithy-runtime-api",
@@ -540,6 +578,7 @@ dependencies = [
  "http 1.4.0",
  "http-body 0.4.6",
  "http-body 1.0.1",
+ "http-body-util",
  "pin-project-lite",
  "pin-utils",
  "tokio",
@@ -548,9 +587,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime-api"
-version = "1.10.0"
+version = "1.11.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efce7aaaf59ad53c5412f14fc19b2d5c6ab2c3ec688d272fd31f76ec12f44fb0"
+checksum = "8c55e0837e9b8526f49e0b9bfa9ee18ddee70e853f5bc09c5d11ebceddcb0fec"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-types",
@@ -565,9 +604,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-types"
-version = "1.3.6"
+version = "1.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65f172bcb02424eb94425db8aed1b6d583b5104d4d5ddddf22402c661a320048"
+checksum = "576b0d6991c9c32bc14fc340582ef148311f924d41815f641a308b5d11e8e7cd"
 dependencies = [
  "base64-simd",
  "bytes",
@@ -1771,7 +1810,7 @@ dependencies = [
  "http 1.4.0",
  "hyper 1.8.1",
  "hyper-util",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-native-certs",
  "rustls-pki-types",
  "tokio",
@@ -1826,7 +1865,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.6.1",
+ "socket2 0.5.10",
  "system-configuration",
  "tokio",
  "tower-service",
@@ -1891,9 +1930,9 @@ dependencies = [
  "proptest",
  "proptest-state-machine",
  "quick_cache",
- "rand 0.9.2",
+ "rand 0.9.4",
  "regex",
- "reqwest 0.12.24",
+ "reqwest 0.12.28",
  "rmp-serde",
  "rmpv",
  "serde",
@@ -1942,7 +1981,7 @@ dependencies = [
  "pyo3",
  "pyo3-async-runtimes",
  "pyo3-bytes",
- "rand 0.9.2",
+ "rand 0.9.4",
  "rmp-serde",
  "serde",
  "serde_json",
@@ -2123,16 +2162,6 @@ version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
 
-[[package]]
-name = "iri-string"
-version = "0.7.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f867b9d1d896b67beb18518eda36fdb77a32ea590de864f1325b294a6d14397"
-dependencies = [
- "memchr",
- "serde",
-]
-
 [[package]]
 name = "is_ci"
 version = "1.2.0"
@@ -2474,8 +2503,8 @@ dependencies = [
  "parking_lot",
  "percent-encoding",
  "quick-xml",
- "rand 0.9.2",
- "reqwest 0.12.24",
+ "rand 0.9.4",
+ "reqwest 0.12.28",
  "ring",
  "rustls-pki-types",
  "serde",
@@ -2730,7 +2759,7 @@ dependencies = [
  "bit-vec",
  "bitflags 2.10.0",
  "num-traits",
- "rand 0.9.2",
+ "rand 0.9.4",
  "rand_chacha 0.9.0",
  "rand_xorshift",
  "regex-syntax",
@@ -2874,8 +2903,8 @@ dependencies = [
  "quinn-proto",
  "quinn-udp",
  "rustc-hash",
- "rustls 0.23.35",
- "socket2 0.6.1",
+ "rustls 0.23.40",
+ "socket2 0.5.10",
  "thiserror 2.0.17",
  "tokio",
  "tracing",
@@ -2891,10 +2920,10 @@ dependencies = [
  "bytes",
  "getrandom 0.3.4",
  "lru-slab",
- "rand 0.9.2",
+ "rand 0.9.4",
  "ring",
  "rustc-hash",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-pki-types",
  "slab",
  "thiserror 2.0.17",
@@ -2912,7 +2941,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.6.1",
+ "socket2 0.5.10",
  "tracing",
  "windows-sys 0.60.2",
 ]
@@ -2945,9 +2974,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.2"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.3",
@@ -3117,9 +3146,9 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.12.24"
+version = "0.12.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d0946410b9f7b082a427e4ef5c8ff541a88b357bc6c637c40db3a68ac70a36f"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -3141,7 +3170,7 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-native-certs",
  "rustls-pki-types",
  "serde",
@@ -3267,15 +3296,15 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.35"
+version = "0.23.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "533f54bc6a7d4f647e46ad909549eda97bf5afc1585190ef692b4286b198bd8f"
+checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
 dependencies = [
  "aws-lc-rs",
  "once_cell",
  "ring",
  "rustls-pki-types",
- "rustls-webpki 0.103.8",
+ "rustls-webpki 0.103.13",
  "subtle",
  "zeroize",
 ]
@@ -3323,9 +3352,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.8"
+version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ffdfa2f5286e2247234e03f680868ac2815974dc39e00ea15adc445d0aafe52"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
  "aws-lc-rs",
  "ring",
@@ -4001,9 +4030,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.48.0"
+version = "1.50.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff360e02eab121e0bc37a2d3b4d4dc622e6eda3a8e5253d5435ecf5bd4c68408"
+checksum = "27ad5e34374e03cfffefc301becb44e9dc3c17584f414349ebe29ed26661822d"
 dependencies = [
  "bytes",
  "libc",
@@ -4052,7 +4081,7 @@ version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
 dependencies = [
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "tokio",
 ]
 
@@ -4101,20 +4130,20 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.6.7"
+version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cf146f99d442e8e68e585f5d798ccd3cad9a7835b917e09728880a862706456"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
  "bitflags 2.10.0",
  "bytes",
  "futures-util",
  "http 1.4.0",
  "http-body 1.0.1",
- "iri-string",
  "pin-project-lite",
  "tower",
  "tower-layer",
  "tower-service",
+ "url",
 ]
 
 [[package]]
@@ -4518,7 +4547,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
diff --git a/deny.toml b/deny.toml
index 1c276f02e..6b2e6eb01 100644
--- a/deny.toml
+++ b/deny.toml
@@ -10,6 +10,14 @@ ignore = [
   # Transitive dev-dependency: noxious-client -> noxious -> bmrng -> loom 0.4 -> generator 0.6
   # bmrng 0.4 pins loom ^0.4 which pins generator ^0.6; upstream hasn't updated
   "RUSTSEC-2020-0151",
+  # rustls-webpki 0.101.7 name constraint bugs: transitive dep via aws-smithy-http-client
+  # -> rustls 0.21. No upgrade path until AWS SDK drops rustls 0.21. Low impact: reachable
+  # only after signature verification and requires CA misissuance to exploit.
+  "RUSTSEC-2026-0098",
+  "RUSTSEC-2026-0099",
+  # rustls-webpki v0.101.7 has a panic related to certificate list revocation.
+  # we don't enable the `clr` feature that would trigger it.
+  "RUSTSEC-2026-0104",
 ]
 
 [licenses]

From 8e30bb85beaac8968e9ab7cfe32c5fa65d3e6e3c Mon Sep 17 00:00:00 2001
From: Luiz Irber <luiz@earthmover.io>
Date: Wed, 20 May 2026 17:15:40 -0300
Subject: [PATCH 09/14] update RUST_CHANNEL to 1.91.1

---
 .github/workflows/code-quality.yaml        | 2 +-
 .github/workflows/dependency-check.yaml    | 2 +-
 .github/workflows/publish-rust-library.yml | 2 +-
 .github/workflows/rust-ci.yaml             | 2 +-
 .github/workflows/windows-check.yml        | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/code-quality.yaml b/.github/workflows/code-quality.yaml
index 67950ada3..a91dd2884 100644
--- a/.github/workflows/code-quality.yaml
+++ b/.github/workflows/code-quality.yaml
@@ -19,7 +19,7 @@ env:
   RUST_BACKTRACE: short
   RUSTFLAGS: "-D warnings -W unreachable-pub -W bare-trait-objects"
   RUSTUP_MAX_RETRIES: 10
-  RUST_CHANNEL: '1.91.0'
+  RUST_CHANNEL: '1.91.1'
 
 jobs:
   code-quality:
diff --git a/.github/workflows/dependency-check.yaml b/.github/workflows/dependency-check.yaml
index f9b689c5d..b6a004592 100644
--- a/.github/workflows/dependency-check.yaml
+++ b/.github/workflows/dependency-check.yaml
@@ -21,7 +21,7 @@ env:
   CI: 1
   RUST_BACKTRACE: short
   RUSTUP_MAX_RETRIES: 10
-  RUST_CHANNEL: '1.91.0'
+  RUST_CHANNEL: '1.91.1'
   CARGO_DENY_VERSION: '0.18.9'
 
 jobs:
diff --git a/.github/workflows/publish-rust-library.yml b/.github/workflows/publish-rust-library.yml
index 1dbb29f6e..9889d3306 100644
--- a/.github/workflows/publish-rust-library.yml
+++ b/.github/workflows/publish-rust-library.yml
@@ -8,7 +8,7 @@ env:
   RUSTFLAGS: "-D warnings -W unreachable-pub -W bare-trait-objects"
   RUSTUP_MAX_RETRIES: 10
   # update RUST_CHANNEL and CARGO_DENY in sync
-  RUST_CHANNEL: '1.91.0'
+  RUST_CHANNEL: '1.91.1'
   CARGO_DENY_VERSION: '0.18.9'
 
 on:
diff --git a/.github/workflows/rust-ci.yaml b/.github/workflows/rust-ci.yaml
index 17e0276a6..fd7d15cd5 100644
--- a/.github/workflows/rust-ci.yaml
+++ b/.github/workflows/rust-ci.yaml
@@ -24,7 +24,7 @@ env:
   RUST_BACKTRACE: short
   RUSTFLAGS: "-D warnings -W unreachable-pub -W bare-trait-objects"
   RUSTUP_MAX_RETRIES: 10
-  RUST_CHANNEL: '1.91.0'
+  RUST_CHANNEL: '1.91.1'
 
 jobs:
   rust:
diff --git a/.github/workflows/windows-check.yml b/.github/workflows/windows-check.yml
index 9d8ed2690..ad3f0356a 100644
--- a/.github/workflows/windows-check.yml
+++ b/.github/workflows/windows-check.yml
@@ -29,7 +29,7 @@ jobs:
       #pull-requests: read
     env:
       #CC: deny_c
-      RUST_CHANNEL: '1.91.0'
+      RUST_CHANNEL: '1.91.1'
 
 
     steps:

From f7a5d3624fe971db37a895915046914d76da3ac9 Mon Sep 17 00:00:00 2001
From: Luiz Irber <luiz@earthmover.io>
Date: Wed, 20 May 2026 17:40:00 -0300
Subject: [PATCH 10/14] update rand for rust; fix rtd config; add explicit
 python version to uvx call

---
 .github/workflows/code-quality.yaml | 2 +-
 .readthedocs.yaml                   | 2 +-
 Cargo.lock                          | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/code-quality.yaml b/.github/workflows/code-quality.yaml
index a91dd2884..9bf30455f 100644
--- a/.github/workflows/code-quality.yaml
+++ b/.github/workflows/code-quality.yaml
@@ -68,7 +68,7 @@ jobs:
         shell: bash
         working-directory: icechunk-python
         run: |
-          uvx --with mypy --with zarr --with hypothesis --with xarray --with dask mypy python
+          uvx --python 3.12 --with mypy --with zarr --with hypothesis --with xarray --with dask mypy python
 
       - name: Run pre-commit checks (skip Rust)
         shell: bash
diff --git a/.readthedocs.yaml b/.readthedocs.yaml
index 6fe1e06e5..952e18c50 100644
--- a/.readthedocs.yaml
+++ b/.readthedocs.yaml
@@ -10,9 +10,9 @@ build:
       - which mamba
       - cd icechunk-python && maturin build && pip install "$(ls ../target/wheels/*.whl | head -n 1)" && pip install --group docs
       - mamba list
-      - cd docs
     build:
       html:
+        - cd docs
         - DISABLE_MKDOCS_2_WARNING=true mkdocs build --site-dir $READTHEDOCS_OUTPUT/html
 
 conda:
diff --git a/Cargo.lock b/Cargo.lock
index c8782b6e7..fe9343218 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2418,7 +2418,7 @@ dependencies = [
  "futures",
  "mockall_double",
  "pin-project-lite",
- "rand 0.8.5",
+ "rand 0.8.6",
  "serde",
  "thiserror 1.0.69",
  "tokio",
@@ -2963,9 +2963,9 @@ checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
 dependencies = [
  "libc",
  "rand_chacha 0.3.1",

From 3b39b092052f5f19116442525a7ecbf69a9eed98 Mon Sep 17 00:00:00 2001
From: Luiz Irber <luiz@earthmover.io>
Date: Wed, 20 May 2026 18:01:32 -0300
Subject: [PATCH 11/14] rtd fix

---
 .readthedocs.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.readthedocs.yaml b/.readthedocs.yaml
index 952e18c50..1db6ced1a 100644
--- a/.readthedocs.yaml
+++ b/.readthedocs.yaml
@@ -12,8 +12,7 @@ build:
       - mamba list
     build:
       html:
-        - cd docs
-        - DISABLE_MKDOCS_2_WARNING=true mkdocs build --site-dir $READTHEDOCS_OUTPUT/html
+        - cd docs && DISABLE_MKDOCS_2_WARNING=true mkdocs build --site-dir $READTHEDOCS_OUTPUT/html
 
 conda:
   environment: docs/doc-env.yml

From 726cbb6963301f69661671fea40ec48675750e3d Mon Sep 17 00:00:00 2001
From: Luiz Irber <luiz@earthmover.io>
Date: Fri, 24 Jul 2026 17:28:32 -0300
Subject: [PATCH 12/14] fix CI failures: mypy zarr resolution, xarray docstring
 sync, docs code block, r2 test

- run mypy with Python 3.11 so uv resolves a zarr without PEP 695 syntax,
  matching mypy's python_version
- backport to_icechunk mode docstring from main to match upstream xarray
- use create_array instead of removed create_dataset in version-control docs
- skip test_r2[public-url]: dataset at v1/era5_weatherbench2 is now v2 format
- align zarr floor with main (>=3.1.0) in pyproject and CI minimum matrix
---
 .github/workflows/code-quality.yaml          |  2 +-
 .github/workflows/python-check.yaml          |  4 ++--
 docs/docs/version-control.md                 |  2 +-
 icechunk-python/integration_tests/test_r2.py |  3 +++
 icechunk-python/pyproject.toml               |  4 ++--
 icechunk-python/python/icechunk/xarray.py    | 20 ++++++++++++++------
 6 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/code-quality.yaml b/.github/workflows/code-quality.yaml
index 9bf30455f..acb104e1b 100644
--- a/.github/workflows/code-quality.yaml
+++ b/.github/workflows/code-quality.yaml
@@ -68,7 +68,7 @@ jobs:
         shell: bash
         working-directory: icechunk-python
         run: |
-          uvx --python 3.12 --with mypy --with zarr --with hypothesis --with xarray --with dask mypy python
+          uvx --python 3.11 --with mypy --with zarr --with hypothesis --with xarray --with dask mypy python
 
       - name: Run pre-commit checks (skip Rust)
         shell: bash
diff --git a/.github/workflows/python-check.yaml b/.github/workflows/python-check.yaml
index 09bce4dee..2b5db96c6 100644
--- a/.github/workflows/python-check.yaml
+++ b/.github/workflows/python-check.yaml
@@ -57,7 +57,7 @@ jobs:
             xarray: "2025.01.2"
             dask: "2024.11.0"
             distributed: "2024.11.0"
-            zarr: "3.0.8"
+            zarr: "3.1.0"
           - name: latest
             xarray: "latest-release"
             dask: "latest-release"
@@ -148,7 +148,7 @@ jobs:
         xarray-version:
           - name: minimum
             version: "2025.01.2"
-            zarr: "3.0.8"
+            zarr: "3.1.0"
           - name: latest-release
             version: "latest-release"
             zarr: "latest-release"
diff --git a/docs/docs/version-control.md b/docs/docs/version-control.md
index 882b20322..e49ec059f 100644
--- a/docs/docs/version-control.md
+++ b/docs/docs/version-control.md
@@ -258,7 +258,7 @@ repo = icechunk.Repository.create(icechunk.in_memory_storage())
 session = repo.writable_session("main")
 root = zarr.create_group(session.store)
 root.attrs["foo"] = "bar"
-root.create_dataset("data", shape=(10, 10), chunks=(1, 1), dtype=np.int32)
+root.create_array("data", shape=(10, 10), chunks=(1, 1), dtype=np.int32)
 print(session.commit(message="Add foo attribute and data array"))
 ```
 
diff --git a/icechunk-python/integration_tests/test_r2.py b/icechunk-python/integration_tests/test_r2.py
index c1a77b527..ffd15a4a3 100644
--- a/icechunk-python/integration_tests/test_r2.py
+++ b/icechunk-python/integration_tests/test_r2.py
@@ -14,6 +14,9 @@
                 anonymous=True,
             ),
             id="public-url",
+            marks=pytest.mark.skip(
+                reason="dataset at v1/era5_weatherbench2 is now Icechunk v2 format"
+            ),
         ),
         pytest.param(
             ic.s3_storage(
diff --git a/icechunk-python/pyproject.toml b/icechunk-python/pyproject.toml
index 10933f694..2253de115 100644
--- a/icechunk-python/pyproject.toml
+++ b/icechunk-python/pyproject.toml
@@ -21,7 +21,7 @@ license = { file = "LICENSE" }
 dynamic = ["version"]
 authors = [{ name = "Earthmover", email = "info@earthmover.io" }]
 
-dependencies = ["zarr>=3,!=3.0.3"]
+dependencies = ["zarr>=3.1.0"]
 
 [dependency-groups]
 test = [
@@ -108,7 +108,7 @@ upstream = [
   "distributed==2025.11.0",
   "dask==2025.11.0",
   "xarray @ git+https://github.com/pydata/xarray.git",
-  "zarr @ git+https://github.com/zarr-developers/zarr.git",
+  #"zarr @ git+https://github.com/zarr-developers/zarr.git",
 ]
 dev = [
   { include-group = "upstream" }
diff --git a/icechunk-python/python/icechunk/xarray.py b/icechunk-python/python/icechunk/xarray.py
index dbf39bfdd..c789cd83e 100644
--- a/icechunk-python/python/icechunk/xarray.py
+++ b/icechunk-python/python/icechunk/xarray.py
@@ -228,14 +228,22 @@ def to_icechunk(
     session : icechunk.Session
         Writable Icechunk Session
     mode : {"w", "w-", "a", "a-", r+", None}, optional
-        Persistence mode: "w" means create (overwrite if exists);
-        "w-" means create (fail if exists);
-        "a" means override all existing variables including dimension coordinates (create if does not exist);
-        "a-" means only append those variables that have ``append_dim``.
-        "r+" means modify existing array *values* only (raise an error if
-        any metadata or shapes would change).
+        Persistence mode:
+
+        - "w" means create (remove old if exists and write new);
+        - "w-" means create (fail if exists);
+        - "a" means override all existing variables including dimension coordinates (create if does not exist);
+        - "a-" means only append those variables that have ``append_dim``.
+        - "r+" means modify existing array *values* only (raise an error if
+          any metadata or shapes would change).
+
         The default mode is "a" if ``append_dim`` is set. Otherwise, it is
         "r+" if ``region`` is set and ``w-`` otherwise.
+
+        .. note::
+            When modifying an existing Zarr array that is lazily opened, the "w"
+            behavior can be surprising since the underlying file that is being
+            lazily read from might get deleted before the data is computed.
     group : str, optional
         Group path. (a.k.a. `path` in zarr terminology.)
     encoding : dict, optional

From 32e6df11d154f9733cba6b0d8ba40ea12fe563e3 Mon Sep 17 00:00:00 2001
From: Luiz Irber <luiz@earthmover.io>
Date: Fri, 24 Jul 2026 18:21:56 -0300
Subject: [PATCH 13/14] fix dependency check and minimum test matrix

- bump minimum matrix to main's values (xarray 2025.07.1, dask/distributed
  2025.2.0): xarray 2025.01.2 is incompatible with zarr 3.1.0
- cargo update anyhow (RUSTSEC-2026-0190) and crossbeam-epoch (RUSTSEC-2026-0204)
- ignore quick-xml advisories as on main, and pyo3 advisories whose fix
  requires 0.29 (affected APIs unused)
---
 .github/workflows/python-check.yaml |  8 ++++----
 Cargo.lock                          |  8 ++++----
 deny.toml                           | 14 ++++++++++++++
 3 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/python-check.yaml b/.github/workflows/python-check.yaml
index 2b5db96c6..58af77974 100644
--- a/.github/workflows/python-check.yaml
+++ b/.github/workflows/python-check.yaml
@@ -54,9 +54,9 @@ jobs:
       matrix:
         deps-version:
           - name: minimum
-            xarray: "2025.01.2"
-            dask: "2024.11.0"
-            distributed: "2024.11.0"
+            xarray: "2025.07.1"
+            dask: "2025.2.0"
+            distributed: "2025.2.0"
             zarr: "3.1.0"
           - name: latest
             xarray: "latest-release"
@@ -147,7 +147,7 @@ jobs:
       matrix:
         xarray-version:
           - name: minimum
-            version: "2025.01.2"
+            version: "2025.07.1"
             zarr: "3.1.0"
           - name: latest-release
             version: "latest-release"
diff --git a/Cargo.lock b/Cargo.lock
index fe9343218..de3ea07b3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -106,9 +106,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.100"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "assert_fs"
@@ -1021,9 +1021,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
diff --git a/deny.toml b/deny.toml
index 6b2e6eb01..c9f909749 100644
--- a/deny.toml
+++ b/deny.toml
@@ -18,6 +18,20 @@ ignore = [
   # rustls-webpki v0.101.7 has a panic related to certificate list revocation.
   # we don't enable the `clr` feature that would trigger it.
   "RUSTSEC-2026-0104",
+  # quick-xml < 0.41.0 DoS advisories (quadratic attribute check / unbounded
+  # namespace allocation): transitive dep via object_store, used only to parse
+  # XML LIST/multipart responses from the S3/GCS/Azure endpoint. No upgrade path
+  # until object_store releases with quick-xml 0.41 (already on their main
+  # branch, unreleased as of 0.14.0). DoS-only (CVSS C:N/I:N/A:H), reachable
+  # only by a malicious/compromised object-store endpoint.
+  "RUSTSEC-2026-0194",
+  "RUSTSEC-2026-0195",
+  # pyo3 0.27 advisories, fixed only in >=0.29: a major bump too disruptive for
+  # the v1.x support branch. OOB read in `nth`/`nth_back` on PyList/PyTuple
+  # iterators (we don't use those methods) and missing `Sync` bound on
+  # `PyCFunction::new_closure` closures (we don't use `new_closure`).
+  "RUSTSEC-2026-0176",
+  "RUSTSEC-2026-0177",
 ]
 
 [licenses]

From b74103396f8a0bd0c30fa560bd5415f4630ff4fb Mon Sep 17 00:00:00 2001
From: Luiz Irber <luiz@earthmover.io>
Date: Fri, 24 Jul 2026 18:42:03 -0300
Subject: [PATCH 14/14] fixes for private methods in zarr.Store

---
 .github/workflows/python-check.yaml           |  2 +-
 .../test_store/test_icechunk_store.py         | 55 ++++++++++++++++++-
 2 files changed, 55 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/python-check.yaml b/.github/workflows/python-check.yaml
index 58af77974..3aaa14b99 100644
--- a/.github/workflows/python-check.yaml
+++ b/.github/workflows/python-check.yaml
@@ -186,7 +186,7 @@ jobs:
           python --version
           WHEEL=$(ls dist/*-cp311-*.whl)
           uv pip install "${WHEEL}" --group test
-          uv pip install pytest-mypy-plugins
+          uv pip install "pytest-mypy-plugins<4"
           # Install specific xarray version based on matrix
           if [ "${{ matrix.xarray-version.version }}" != "latest-release" ]; then
             echo "Installing xarray ${{ matrix.xarray-version.version }}"
diff --git a/icechunk-python/tests/test_zarr/test_store/test_icechunk_store.py b/icechunk-python/tests/test_zarr/test_store/test_icechunk_store.py
index 43577e94e..33e8f5606 100644
--- a/icechunk-python/tests/test_zarr/test_store/test_icechunk_store.py
+++ b/icechunk-python/tests/test_zarr/test_store/test_icechunk_store.py
@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import json
 import pickle
 from pathlib import Path
 from typing import Any, TypeVar
@@ -10,7 +11,7 @@
 from icechunk.repository import Repository
 from zarr.abc.store import OffsetByteRequest, RangeByteRequest, Store, SuffixByteRequest
 from zarr.core.buffer import Buffer, cpu, default_buffer_prototype
-from zarr.core.sync import _collect_aiterator, collect_aiterator
+from zarr.core.sync import _collect_aiterator, collect_aiterator, sync
 from zarr.testing.store import StoreTests
 from zarr.testing.utils import assert_bytes_equal
 
@@ -529,3 +530,55 @@ async def test_getsize_raises(self, store: IcechunkStore) -> None:
         # TODO: This maybe should be a FileNotFoundError instead of an IcechunkError
         with pytest.raises(IcechunkError):
             await store.getsize("not-a-real-key")
+
+    @pytest.mark.skipif(
+        not hasattr(Store, "_get_bytes"),
+        reason="Store._get_bytes only exists in zarr >=3.1.6,<3.3",
+    )
+    async def test_get_bytes(self, store: IcechunkStore) -> None:
+        # Override: icechunk validates metadata on zarr.json keys,
+        # so we must use valid zarr metadata instead of arbitrary bytes
+        data = DEFAULT_GROUP_METADATA
+        key = "zarr.json"
+        await self.set(store, key, self.buffer_cls.from_bytes(data))
+        assert await store._get_bytes(key, prototype=default_buffer_prototype()) == data
+        with pytest.raises((FileNotFoundError, ValueError, IcechunkError)):
+            await store._get_bytes(
+                "nonexistent_key", prototype=default_buffer_prototype()
+            )
+
+    @pytest.mark.skipif(
+        not hasattr(Store, "_get_bytes_sync"),
+        reason="Store._get_bytes_sync only exists in zarr >=3.1.6,<3.3",
+    )
+    def test_get_bytes_sync(self, store: IcechunkStore) -> None:
+        # Override: icechunk validates metadata on zarr.json keys
+        data = DEFAULT_GROUP_METADATA
+        key = "zarr.json"
+        sync(self.set(store, key, self.buffer_cls.from_bytes(data)))
+        assert store._get_bytes_sync(key, prototype=default_buffer_prototype()) == data
+
+    @pytest.mark.skipif(
+        not hasattr(Store, "_get_json"),
+        reason="Store._get_json only exists in zarr >=3.1.6,<3.3",
+    )
+    async def test_get_json(self, store: IcechunkStore) -> None:
+        # Override: icechunk validates metadata on zarr.json keys,
+        # so we must use valid zarr metadata instead of arbitrary JSON
+        data = json.loads(DEFAULT_GROUP_METADATA)
+        data_bytes = DEFAULT_GROUP_METADATA
+        key = "zarr.json"
+        await self.set(store, key, self.buffer_cls.from_bytes(data_bytes))
+        assert await store._get_json(key, prototype=default_buffer_prototype()) == data
+
+    @pytest.mark.skipif(
+        not hasattr(Store, "_get_json_sync"),
+        reason="Store._get_json_sync only exists in zarr >=3.1.6,<3.3",
+    )
+    def test_get_json_sync(self, store: IcechunkStore) -> None:
+        # Override: icechunk validates metadata on zarr.json keys
+        data = json.loads(DEFAULT_GROUP_METADATA)
+        data_bytes = DEFAULT_GROUP_METADATA
+        key = "zarr.json"
+        sync(self.set(store, key, self.buffer_cls.from_bytes(data_bytes)))
+        assert store._get_json_sync(key, prototype=default_buffer_prototype()) == data