Hi all, As discussed in GH-55165 (https://github.com/apache/arrow/issues/55165), arrow statically link Brotli 1.0.9, which is affected by CVE-2026-111497. The fix (https://github.com/apache/arrow/pull/55167) has been approved.
Is it planned to include this fix in the 26.0.1 pyarrow patch release, and is there an expected release date? If not, which release should we expect it in? Thanks, Javier
