[MikolajBalcerek]

SUMMARY

Related: #45743

Bumps pyarrow floor - their wheels statically bundle their own brotli - https://github.com/microsoft/vcpkg/blob/61d7eaeb094a6acbc23d9c2e54de9208175fda47/ports/brotli/vcpkg.json#L3

The 26.0.0 wheels bundle Brotli 1.2.0, which was affected by CVE-2026-111497 (out-of-bounds write in the Brotli decoder): apache/arrow#55167.

In theory it might be exploitable when reading Brotli-compressed Parquet, e.g. via Parquet upload - if you have "upload to database" allowed in Superset, and user sends prepared parquet.

To be safe in the meantime, I would recommend disabling upload to database in Database settings in previous releases of Superset, where Superset's pyarrow has lower ceiling

TESTING INSTRUCTIONS

Ran on a 7.0.0rc2 deployment with pyarrow overridden to 26.0.1 (pandas 2.3.3, Postgres metadata DB):

• env started
• no issues connecting to postgres, Athena DBs

[codeant-ai-for-open-source]

  CodeAnt PR Risk

🟢  Low Risk

• The PR appears safe to merge; no actionable issues were identified in the review.

Assessed commit: c924a18e76c9

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.02%. Comparing base (3cd5c5d) to head (c924a18).
⚠️ Report is 24 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #46018      +/-   ##
==========================================
+ Coverage   84.99%   85.02%   +0.03%     
==========================================
  Files        3080     3080              
  Lines      209131   209578     +447     
  Branches    49278    49324      +46     
==========================================
+ Hits       177755   178204     +449     
- Misses      27993    27996       +3     
+ Partials     3383     3378       -5     

Flag	Coverage Δ
hive	34.17% <ø> (-0.04%)	⬇️
mysql	51.97% <ø> (-0.07%)	⬇️
postgres	51.98% <ø> (-0.07%)	⬇️
presto	35.83% <ø> (-0.04%)	⬇️
python	87.99% <ø> (+0.04%)	⬆️
sqlite	51.72% <ø> (-0.08%)	⬇️
unit	82.95% <ø> (+0.08%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sadpandajoe]

Should we be updating this line too as the bump is now for a different reason.

[MikolajBalcerek]

updated here - c924a18

[netlify]

✅ Deploy Preview for superset-docs-preview ready!

Name	Link
🔨 Latest commit	c924a18
🔍 Latest deploy log	https://app.netlify.com/projects/superset-docs-preview/deploys/6aedb77528352f3c6edd79e7
😎 Deploy Preview	https://deploy-preview-46018--superset-docs-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[sha174n]

LGTM. Patch bump (26.0.0 -> 26.0.1) within the existing major floor, so compatibility risk is minimal, and it closes CVE-2026-111497 in pyarrow's statically-bundled Brotli.

Confirmed the reachability independently: reading a Brotli-compressed Parquet through the columnar upload path (pd.read_parquet / pq.ParquetFile in columnar_reader.py) routes the uploaded bytes into the bundled decoder on affected pyarrow builds. Your "in theory ... via Parquet upload" is reproducible in practice, so the interim guidance to disable upload-to-database on older releases is the right call where the pyarrow ceiling can't reach 26.0.1.