Pyarrow<=11 upper bound

Open

#1,953 opened on Nov 28, 2023 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 25/100

Issue type: Bug
Clarity: Needs clarification
Activity status: Stale
Tech stack: python
Domain: machine-learning

Research direction

Start by reproducing the dependency conflict involving azureml-dataset-runtime 1.54.0 and pyarrow in the affected environment. Review the CVE-2023-47248 advisory and the pyarrow-hotfix package, then identify the relevant notebook or environment setup. Done means the supported dependency range no longer forces the vulnerable version and the affected setup completes successfully.

Written by the indexing model from the issue text.

Description

Hi,
Pyarrow has a critical CVE.
https://www.cve.org/CVERecord?id=CVE-2023-47248

There is a hotfix if anybody needs it in the meantime
https://pypi.org/project/pyarrow-hotfix/

azureml-dataset-runtime 1.54.0 requires pyarrow<=11.0.0,>=0.17.0, but you have pyarrow 14.0.0 which is incompatible.

Dominant language: Jupyter Notebook
Stars: 4.4k
Forks: 2.6k
PR merge metrics: No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Adam and SGD partially update parameters before rejecting a short gradient list Open

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

NVIDIA/warp#1979 · Opened Sep 22, 2026
pad_training_input_batch pads TensorList fields with tensor[0].clone() — loss-masked pad rows carry a real row's payload (ragged-consumer crash; wrong pixel_values/image_grid_thw on pad rows) Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

NovaSky-AI/SkyRL#2263 · Opened Sep 22, 2026
DUDE_acc: an empty prediction becomes NaN after the TSV round-trip and scores the whole set at zero Open

Difficulty 1/5 Under an hour Newbie friendliness 90/100

open-compass/VLMEvalKit#1704 · Opened Sep 22, 2026
--include_path added in 0.10.X does not delete the folder in mlops run fails Open

Difficulty 2/5 1-3 hours Newbie friendliness 64/100

GSTT-CSC/MLOps#189 · Opened Sep 22, 2026
flan MMLU MultiChoiceRegexFilter raises IndexError on an all-empty capture tuple (bbh fix #4125 missed these copies) Open

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

EleutherAI/lm-evaluation-harness#4207 · Opened Sep 22, 2026

More Machine Learning issues