Relax pyarrow<20 pin: blocks the fix for GHSA-rgxp-2hwp-jwgg #283

Summary

ultrack 0.7.2 declares pyarrow<20,>=16.1.0. That upper bound holds downstream projects on a pyarrow version flagged by GHSA-rgxp-2hwp-jwgg (high severity, Apache Arrow C++ use-after-free), which is not patched until pyarrow 23.0.1. Since 0.7.2 is the latest release, there is currently no way for a dependent to satisfy both ultrack and the advisory.

Would you consider relaxing the cap to allow pyarrow>=23.0.1?

Context

We hit this in biahub, where ultrack is an optional dependency for tracking. After refreshing our lockfile, this was the only Dependabot alert we could not clear — every other advisory resolved, but pyarrow stayed pinned at 19.0.1 by the transitive cap.

Worth noting for triage: the advisory is arguably not exploitable through the Python binding. It says the vulnerable pre-buffering path

is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable.

So this is a supply-chain/reporting problem rather than a runtime security problem — but it still surfaces as a high-severity alert for everyone depending on ultrack, and there is no way to dismiss it at the dependent's level without hiding a real signal.

Secondary benefit

The same cap blocks Python 3.14 support: pyarrow 19 ships no cp314 wheels, so installation falls back to building from sdist and fails without a local Arrow C++ toolchain. Allowing pyarrow >=20 would unblock 3.14 for the whole dependent tree.

Happy to help

If the cap is just conservative rather than pinned to a known incompatibility, I am glad to open a PR bumping it and confirming the test suite passes against a current pyarrow.