pyarrow-hotfix

pyarrow-hotfix Permissive license Apache License, Version 2.0 AGING ★ 2 v0.7 released 2025-04-25

Install

pyarrow-hotfix on PyPI

pip

pip install pyarrow-hotfix

uv

uv add pyarrow-hotfix

poetry

poetry add pyarrow-hotfix

Package facts

License	Apache License, Version 2.0 (permissive)
Python support	supports the current Python release (>=3.5)
Install friction	low — pure-Python wheel
Runtime dependencies	none
Maintenance	aging — 475 days since the last release
Last repo commit	2025-04-25
First released	2023-11-08
Popularity	one of the top 1,000 most-downloaded packages on PyPI (30-day window, as of 2026-08-13)
Known vulnerabilities	none known (OSV.dev, checked 2026-08-13)

Evidence: pyarrow_hotfix-0.7-py3-none-any.whl

Development Status :: 4 - BetaOperating System :: OS IndependentProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.5Programming Language :: Python :: 3.6Programming Language :: Python :: 3.7Programming Language :: Python :: 3.8Programming Language :: Python :: 3.9

About pyarrow-hotfix

from the package's own PyPI description — quoted content, verbatim

PyArrow Hotfix

.. image:: https://img.shields.io/pypi/v/pyarrow-hotfix.svg :alt: pyarrow_hotfix package on PyPI :target: https://pypi.org/project/pyarrow-hotfix

.. image:: https://img.shields.io/pypi/pyversions/pyarrow-hotfix.svg :alt: pyarrow_hotfix supported Python versions :target: https://pypi.org/project/pyarrow-hotfix

.. image:: https://github.com/pitrou/pyarrow-hotfix/actions/workflows/tests.yml/badge.svg :alt: latest unit test results :target: https://github.com/pitrou/pyarrow-hotfix/actions/workflows/tests.yml

Description

This is a hotfix for the PyArrow security vulnerability CVE-2023-47248 <https://www.cve.org/CVERecord?id=CVE-2023-47248>__.

We generally recommend upgrading to PyArrow 14.0.1 or later, but if you cannot upgrade, this package disables the vulnerability on older versions.

Installation

Use pip to install:

.. code-block:: console

pip install pyarrow_hotfix

.. note:: Both pyarrow-hotfix and pyarrow_hotfix are accepted and point to the same package.

Usage

pyarrow_hotfix must be imported in your application or library code for it to take effect:

.....

Read as markdown · JSON record · Source repository · Docs

AI interpretation — verify before relying

AI-generated interpretation of the package facts above; every digit, version, license, or vulnerability id it cites is grounded in the facts already shown on this page

Disables the PyArrow CVE-2023-47248 deserialization vulnerability on PyArrow versions before 14.0.1 by patching unsafe pickle handling when imported.

Low friction: pure Python wheel with no runtime dependencies, though maintenance is aging (475 days since last release). Repository remains active and the package is in top 1000 PyPI by popularity.

Apache License 2.0 is permissive; you may use, modify, and distribute this package freely in commercial or private projects with minimal restrictions.

Usage

pip install pyarrow_hotfix

import pyarrow as pa
import pyarrow_hotfix

# Now pa.ipc.open_file() and related deserialization is protected

Requires PyArrow 0.14.0 or later to be installed separately; Python 3.5 or later.

Verdict: A lightweight, dependency-free security patch for older PyArrow installations vulnerable to CVE-2023-47248. Recommended only if you cannot upgrade PyArrow itself to 14.0.1+; otherwise upgrading PyArrow directly is the better path. No known vulnerabilities in the hotfix itself.

Needs verification

Whether the 475-day gap since last release (2025-04-25 is recent but fact sheet may be stale) reflects active maintenance or dormancy.
Confirmation that importing pyarrow_hotfix before any PyArrow deserialization is sufficient to patch all entry points in real-world code.

pyarrow security hotfixcve-2023-47248 patchpyarrow deserialization vulnerabilityarrow pickle exploit mitigationpyarrow 14 backport securityunsafe deserialization protection