--- id: pyarrow-hotfix version: "0.7" license: Apache License, Version 2.0 license_treatment: permissive maintenance: aging --- # pyarrow-hotfix License: permissive · Maintenance: aging · Popularity: top 1,000 on PyPI ## Install pip install pyarrow-hotfix uv add pyarrow-hotfix poetry add pyarrow-hotfix ## Description PyArrow Hotfix ============== .. image:: https://img.shields.io/pypi/v/pyarrow-hotfix.svg :alt: pyarrow_hotfix package on PyPI :target: https://pypi.org/project/pyarrow-hotfix .. image:: https://img.shields.io/pypi/pyversions/pyarrow-hotfix.svg :alt: pyarrow_hotfix supported Python versions :target: https://pypi.org/project/pyarrow-hotfix .. image:: https://github.com/pitrou/pyarrow-hotfix/actions/workflows/tests.yml/badge.svg :alt: latest unit test results :target: https://github.com/pitrou/pyarrow-hotfix/actions/workflows/tests.yml Description ----------- This is a hotfix for the PyArrow security vulnerability `CVE-2023-47248 `__. We generally recommend upgrading to PyArrow 14.0.1 or later, but if you cannot upgrade, this package disables the vulnerability on older versions. Installation ------------ Use ``pip`` to install: .. code-block:: console pip install pyarrow_hotfix .. note:: Both ``pyarrow-hotfix`` and ``pyarrow_hotfix`` are accepted and point to the same package. Usage ----- ``pyarrow_hotfix`` must be imported in your application or library code for it to take effect: ..... ## AI interpretation — verify before relying Disables the PyArrow CVE-2023-47248 deserialization vulnerability on PyArrow versions before 14.0.1 by patching unsafe pickle handling when imported. Verdict: A lightweight, dependency-free security patch for older PyArrow installations vulnerable to CVE-2023-47248. Recommended only if you cannot upgrade PyArrow itself to 14.0.1+; otherwise upgrading PyArrow directly is the better path. No known vulnerabilities in the hotfix itself. [View on SkillFed](https://skillfed.io/packages/pyarrow-hotfix) · [View on PyPI](https://pypi.org/project/pyarrow-hotfix/)