Repository navigation
GH-55165: [C++] Force newer versions of Brotli - #55167
Open
CurtHagenlocher wants to merge 2 commits into
Open
CurtHagenlocher wants to merge 2 commits into
CurtHagenlocher wants to merge 2 commits into
Conversation
CurtHagenlocher
requested review from
assignUser,
jonkeane,
kou and
raulcd
as code owners
October 23, 2026 23:40
|
|
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The Windows wheel image revision must also change to prevent cached images from bypassing the Brotli upgrade.
1 open issue
What changed in this PR
This PR updates bundled Brotli versions across Arrow’s C++ build paths, addressing GH-55165.
Changes:
- Updates the CMake dependency pin to Brotli 1.0.10 and its checksum.
- Updates the Meson fallback to Brotli 1.1.1 with local build definitions and licensing.
- Patches vcpkg to use Brotli 1.2.1 with an updated checksum.
| File | Description |
|---|---|
cpp/thirdparty/versions.txt |
Updates the bundled Brotli version and checksum. |
cpp/subprojects/packagefiles/google-brotli/meson.build |
Adds local Meson build definitions for Brotli. |
cpp/subprojects/packagefiles/google-brotli/LICENSE.build |
Includes licensing for the Meson build definitions. |
cpp/subprojects/google-brotli.wrap |
Updates the source archive and selects the local build overlay. |
ci/vcpkg/ports.patch |
Updates the vcpkg Brotli version and checksum. |
Review effort: Balanced
…image - Apply meson-fmt to the vendored google-brotli meson.build (whitespace only). - Bump PYTHON_WHEEL_WINDOWS_IMAGE_REVISION so Windows wheel CI rebuilds its cached image with the patched vcpkg brotli 1.2.1 port instead of reusing the existing image built with 1.2.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
@github-actions crossbow submit wheel-windows-* |
|
Revision: 747092e Submitted crossbow builds: ursacomputing/crossbow @ actions-41b08c9f7f
|
rok
approved these changes
Oct 24, 2026
github-actions
Bot
added
awaiting merge
magifd2
added a commit
to nlink-jp/data-toolbox-mcp
that referenced
this pull request
Oct 25, 2026
CVE-2026-111497 (Brotli decoder out-of-bounds write) affects the Brotli 1.0.9 that Arrow 18 bundles. Apache Arrow ships fixes only in new major versions — the Brotli update (apache/arrow#55167, unmerged) targets main — so `pyarrow~=18.0` could never take it. pyarrow is now `>=18.0`; a rebuild installs 26.0.0 today (not fixed yet either) and the first fixed major on the rebuild after it ships. The manifest advertises the same constraint. The other packages keep `~=`: pandas 3, polars 2, DuckDB 2 and Pillow 13 change the API LLM-written code uses. With pyarrow 26.0.0, pandas 2.3.3, polars 1.44.2 and DuckDB 1.5.6, `pip check` is clean and parquet / DataFrame / DuckDB round-trips match pyarrow 18.1.0. ADR-0007 is amended and records what this release does not fix: DuckDB's vendored Brotli 1.1.0 (upstream fix unmerged) and Pillow's bundled libbrotlidec (WOFF2 only, not reached here). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rationale for this change
It seemed like a good time for a change.
What changes are included in this PR?
Newer versions of the Brotli dependency are forced by the build.
Are these changes tested?
Presumably the relevant code paths already have tests.
Are there any user-facing changes?
No.
Was AI used for this PR?
PR code and description written by:
Reviewed before submission by: