feat: upgrade to ggsql 0.5.2 with native SVG/PDF/HEP writers

.github/workflows/python.yml

@@ -11,14 +11,23 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        # NOTE: windows is pinned to windows-2022 (not windows-latest).
+        # ggsql 0.5.2 pins duckdb ~1.10502, whose bundled build uses
+        # stdext::checked_array_iterator (via vendored fmt). That symbol is
+        # deprecated but present in windows-2022's VS2022/v143 STL, and fully
+        # removed in the VS2026/v145 STL that windows-latest now provides, so
+        # the duckdb build hard-fails there (duckdb/duckdb-rs#783, fixed in
+        # libduckdb-sys 1.10506). Upstream ggsql pins windows-2022 for the
+        # same reason. Revert to windows-latest once we depend on a ggsql
+        # release with duckdb ~1.10506.
+        os: [ubuntu-latest, macos-latest, windows-2022]
         python: ["3.10", "3.11", "3.12", "3.13"]
         include:
           - os: ubuntu-latest
             delay: 140
           - os: macos-latest
             delay: 210
-          - os: windows-latest
+          - os: windows-2022
             delay: 70
     runs-on: ${{ matrix.os }}
     steps:
@@ -68,3 +77,42 @@ jobs:
       - name: Run tests
         shell: bash
         run: pytest tests/ -v
+
+      # The abi3 wheel is identical across Python legs; keep just one for
+      # the wheel smoke test below.
+      - name: Upload Linux wheel
+        if: runner.os == 'Linux' && matrix.python == '3.13'
+        uses: actions/upload-artifact@v4
+        with:
+          name: ggsql-wheel
+          path: target/wheels/ggsql-*.whl
+          retention-days: 5
+
+  # Native SVG/PDF/HEP writers dlopen libfontconfig.so.1 at runtime and
+  # need installed fonts — neither is expressible in wheel metadata, and
+  # slim Linux images lack both. Render in a minimal container provisioned
+  # per the README to catch packaging/runtime regressions.
+  wheel-smoke-test:
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      # NOTE: checkout must precede the download — it cleans the workspace.
+      - uses: actions/checkout@v4
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: ggsql-wheel
+          path: wheelhouse
+
+      - name: Smoke test wheel in a minimal container
+        run: |
+          WHEEL=$(basename wheelhouse/*.whl)
+          docker run --rm \
+            -v "$GITHUB_WORKSPACE/wheelhouse:/wheels:ro" \
+            -v "$GITHUB_WORKSPACE/scripts/smoke_test_wheel.py:/smoke_test.py:ro" \
+            python:3.12-slim bash -euxo pipefail -c "
+              apt-get update &&
+              apt-get install -y --no-install-recommends libfontconfig1 fonts-dejavu-core &&
+              pip install --no-cache-dir '/wheels/$WHEEL' &&
+              python /smoke_test.py
+            "

.github/workflows/release-python.yml

@@ -70,8 +70,12 @@ jobs:
           name: wheels-macos-${{ matrix.target }}
           path: dist
 
+  # Pinned to windows-2022: bundled duckdb (via ggsql 0.5.2's duckdb
+  # ~1.10502 pin) does not compile on windows-latest's VS2026/v145 STL.
+  # See the matching note in python.yml. Revert once ggsql depends on
+  # duckdb ~1.10506.
   windows:
-    runs-on: windows-latest
+    runs-on: windows-2022
     steps:
       - uses: actions/checkout@v4
 

CHANGELOG.md

@@ -1,18 +1,33 @@
 # Changelog
 
-## UNRELEASED
+## 0.5.2
+
+### Added
+
+- New native writers `SVGWriter`, `PDFWriter`, and `HepWriter`, rendered directly by ggsql (via hephaestus) with no JavaScript round-trip. Each exposes `render(spec)` returning `str` (SVG) or `bytes` (PDF/HEP); render warnings are surfaced via `warnings.warn()`.
+- New `ggsql.save(spec, file, ...)` helper that writes a spec to disk, picking the writer from the file extension (`.svg`, `.pdf`, `.hep`, or `.json` for Vega-Lite).
+- Enabled the crate's `builtin-data` feature, making builtin datasets such as `ggsql:world` available.
+
+### Changed
+
+- Upgraded to ggsql Rust crate v0.5.2 (from v0.3.3). See the [crate changelog](https://github.com/posit-dev/ggsql/blob/main/CHANGELOG.md) for the many language and rendering improvements in 0.4.0–0.5.2.
+- Upgraded the Arrow dependency from v56 to v58.
+- Declared Rust MSRV is now 1.88 (required by the native-writer dependency graph, e.g. parley 0.9).
+
+## 0.3.3
 
 ### Changed
 
+- Upgraded to ggsql Rust crate v0.3.3 (hotfix).
 - `VegaLiteWriter.render_chart()` and `render_altair()` now accept `validate`, `height`, and `width` as explicit keyword arguments. `height` and `width` default to `None`, which preserves whatever dimensions ggsql produces. `validate` defaults to `False` (same behavior as before, now a named parameter).
+- When Altair can't deserialize a spec into the expected chart subclass (e.g., `LayerChart`), the converter now falls back to `altair.Chart` instead of raising. The chart still displays correctly; only Altair-level round-tripping (`.to_dict()`) is lost.
 
 ## 0.3.2
 
 ### Changed
 
 - Upgraded to ggsql Rust crate v0.3.2.
 - `render_altair()` and `VegaLiteWriter.render_chart()` now default to `validate=False` when creating Altair chart objects. This avoids `ValidationError`s for valid specs (e.g., boxplots) that use Vega-Lite features not yet reflected in Altair's schema. Pass `validate=True` to re-enable.
-- When Altair can't deserialize a spec into the expected chart subclass (e.g., `LayerChart`), the converter now falls back to `altair.Chart` instead of raising. The chart still displays correctly; only Altair-level round-tripping (`.to_dict()`) is lost.
 
 ## 0.3.1
 

CLAUDE.md

@@ -38,6 +38,16 @@ To pick up a new version of the upstream `ggsql` Rust crate, bump its version in
 
 **Key design pattern**: Two-stage API — `reader.execute(query) -> Spec`, then `writer.render(spec) -> str` or `writer.render_chart(spec) -> AltairChart`. The `render_altair()` shortcut collapses both stages.
 
+## Releasing
+
+The Python Release workflow (`.github/workflows/release-python.yml`) triggers on tags matching `py/v*`. When creating a GitHub release, use `gh release create py/vX.Y.Z` — a plain `vX.Y.Z` tag won't trigger the build/publish pipeline.
+
+Release checklist (all in the bump commit, before tagging):
+
+1. Rename the `## UNRELEASED` section of `CHANGELOG.md` to the new version.
+2. Bump `version` in `pyproject.toml` and `Cargo.toml`, then run `uv sync` to update `uv.lock` and `Cargo.lock`. (`ggsql.__version__` follows automatically via `importlib.metadata`.)
+3. After the release workflow finishes, check that the GitHub release notes summarize the changelog section — edit with `gh release edit py/vX.Y.Z` if needed.
+
 ## `.cargo/config.toml`
 
 Sets `GGSQL_SKIP_GENERATE=1` so tree-sitter uses its pre-generated parser rather than regenerating from `grammar.js`. Don't remove this.