florianvazelle opened a new pull request, #29134: URL: https://github.com/apache/flink/pull/29134
## What is the purpose of the change Raise PyFlink's `pyarrow` upper bound from `<21.0.0` to `<26.0.0` so Python 3.10+ environments can install pyarrow 25.x. That also unblocks installing Arrow C++ 23.0.1+, which is the fix for [CVE-2026-25087](https://nvd.nist.gov/vuln/detail/CVE-2026-25087) (use-after-free in Arrow C++ 15.0.0–23.0.0 when reading an IPC *file* with pre-buffering). The previous `<21` cap made a patched pyarrow uninstallable. This change does not raise the lower bound, so older pyarrow versions can still be resolved. Arrow Java is left at `19.0.0`. Python 3.9 remains supported by Flink. pyarrow 22 dropped 3.9 wheels, so pip on 3.9 will keep resolving a 21.x wheel inside the new range. ## Brief change log - Raise `pyarrow` from `>=5.0.0,<21.0.0` to `>=5.0.0,<26.0.0` in `flink-python/setup.py` and `flink-python/pyproject.toml` - Document in `flink-python/pom.xml` that Arrow Java is not version-aligned with pyarrow (still `19.0.0`) ## Verifying this change This change is already covered by existing tests, such as: - `pyflink.table.tests.test_types.ArrowTypeConversionTests` (Arrow ↔ Flink type mapping) - pandas UDF / UDAF tests (`test_pandas_udaf`, vectorized operations) - `Table.to_pandas` / Arrow serializer tests (`test_table_environment_api`) - DataFrame Arrow conversion tests (`pyflink.dataframe.tests.test_convert`) CI should install pyarrow 25.x on Python 3.10+ and a 21.x wheel on Python 3.9. ## Does this pull request potentially affect one of the following parts: - Dependencies (does it add or upgrade a dependency): yes (raises the pyarrow upper bound; Arrow Java unchanged) - The public API, i.e., is any changed class annotated with `@Public(Evolving)`: no - The serializers: no - The runtime per-record code paths (performance sensitive): no - Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no - The S3 file system connector: no ## Documentation - Does this pull request introduce a new feature? no - If yes, how is the feature documented? not applicable -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
