data-validation icon indicating copy to clipboard operation
data-validation copied to clipboard

Update pyarrow version range to address vulnerability CVE-2023-47248

Open serhio-k opened this issue 2 years ago • 3 comments

Hi,

current pyarrow dependency version is set to pyarrow>=10,<11. However, there is a known vulnerability in pyarrow with the CVE-2023-47248. I'd like to propose bumping the pyarrow version to a range of pyarrow>=14.0.1,<15, which should include the necessary fix for the aforementioned vulnerability. This version range should not introduce compatibility issues while ensuring we are using a secure version of the library.

serhio-k avatar Nov 22 '23 15:11 serhio-k