Hi, We are currently working towards a 26.0.1 patch release. It would contain https://github.com/apache/arrow/issues/55165.
As per timeline, we are fixing various CI issues, once we have a RC it will be shared on the Mailing List for voting and release. You can follow the release as per the usual process. Regards, Raúl El jue, 29 oct 2026 a las 8:47, Javier Guerrero (<[email protected]>) escribió: > > Hi all, > > As discussed in GH-55165 (https://github.com/apache/arrow/issues/55165), > arrow statically link Brotli 1.0.9, which is affected by CVE-2026-111497. > The fix (https://github.com/apache/arrow/pull/55167) has been merged. > > Is it planned to include this fix in the 26.0.1 pyarrow patch release, and > is there an expected release date? If not, which release should we expect > it in? > > Thanks, > > Javier
