This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/arrow-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new 57516893bd9 Updating built site
57516893bd9 is described below
commit 57516893bd99c7f6efaa6560d3712b2ad09ae2a5
Author: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
AuthorDate: Tue Oct 20 21:15:11 2026 +0000
Updating built site
---
blog/2026/10/08/26.0.0-release/index.html | 3 +++
feed.xml | 7 +++++--
release/index.html | 6 +++---
3 files changed, 11 insertions(+), 5 deletions(-)
diff --git a/blog/2026/10/08/26.0.0-release/index.html
b/blog/2026/10/08/26.0.0-release/index.html
index 1f8191fe895..a5652b309f7 100644
--- a/blog/2026/10/08/26.0.0-release/index.html
+++ b/blog/2026/10/08/26.0.0-release/index.html
@@ -317,6 +317,9 @@ reduces the size of <code>libarrow</code> for users who do
not need S3. C++ user
filesystem now need to either link against <code>libarrow_s3</code> or load it
at runtime
using <code>LoadFileSystemFactories</code>.</p>
<h3>Parquet</h3>
+<h4>CVE-2026-92287: Parquet file-controlled KMS URL is forwarded to pluggable
KmsClient that skips host validation</h4>
+<p>A security issue was fixed where KMS URLs embedded in Parquet files were
forwarded to a user-implemented KMS client. This is now disabled by default but
can be optionally enabled, in which case users should ensure they validate the
KMS URLs received (<a href="https://github.com/apache/arrow/issues/51349";
target="_blank" rel="noopener">GH-51349</a>).</p>
+<p>See our <a
href="https://lists.apache.org/thread/0t6vry0msbk9dpsd0xv395ov5b84hj57";
target="_blank" rel="noopener">separate announcement</a> for further detail.</p>
<p>The schema nesting depth is now limited when parsing the Thrift metadata of
a
Parquet file, turning a stack overflow on pathologically nested schemas into a
regular error (<a href="https://github.com/apache/arrow/issues/51238";
target="_blank" rel="noopener">GH-51238</a>). The default limit (100) can be
raised if needed.</p>
diff --git a/feed.xml b/feed.xml
index 2fd506f53a4..0c6578c1127 100644
--- a/feed.xml
+++ b/feed.xml
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><feed
xmlns="http://www.w3.org/2005/Atom"; ><generator uri="https://jekyllrb.com/";
version="4.4.1">Jekyll</generator><link
href="https://arrow.apache.org/feed.xml"; rel="self" type="application/atom+xml"
/><link href="https://arrow.apache.org/"; rel="alternate" type="text/html"
/><updated>2026-10-20T12:58:07-04:00</updated><id>https://arrow.apache.org/feed.xml</id><title
type="html">Apache Arrow</title><subtitle>Apache Arrow is the universal
columnar fo [...]
+<?xml version="1.0" encoding="utf-8"?><feed
xmlns="http://www.w3.org/2005/Atom"; ><generator uri="https://jekyllrb.com/";
version="4.4.1">Jekyll</generator><link
href="https://arrow.apache.org/feed.xml"; rel="self" type="application/atom+xml"
/><link href="https://arrow.apache.org/"; rel="alternate" type="text/html"
/><updated>2026-10-20T14:19:27-04:00</updated><id>https://arrow.apache.org/feed.xml</id><title
type="html">Apache Arrow</title><subtitle>Apache Arrow is the universal
columnar fo [...]
-->
<p>The Apache Arrow team is pleased to announce the 26.0.0 release. This
release
@@ -49,6 +49,9 @@ reduces the size of <code>libarrow</code> for users who do
not need S3. C++ user
filesystem now need to either link against <code>libarrow_s3</code> or load it
at runtime
using <code>LoadFileSystemFactories</code>.</p>
<h3>Parquet</h3>
+<h4>CVE-2026-92287: Parquet file-controlled KMS URL is forwarded to pluggable
KmsClient that skips host validation</h4>
+<p>A security issue was fixed where KMS URLs embedded in Parquet files were
forwarded to a user-implemented KMS client. This is now disabled by default but
can be optionally enabled, in which case users should ensure they validate the
KMS URLs received (<a
href="https://github.com/apache/arrow/issues/51349";>GH-51349</a>).</p>
+<p>See our <a
href="https://lists.apache.org/thread/0t6vry0msbk9dpsd0xv395ov5b84hj57";>separate
announcement</a> for further detail.</p>
<p>The schema nesting depth is now limited when parsing the Thrift metadata of
a
Parquet file, turning a stack overflow on pathologically nested schemas into a
regular error (<a
href="https://github.com/apache/arrow/issues/51238";>GH-51238</a>). The default
limit (100) can be raised if needed.</p>
@@ -167,7 +170,7 @@ changelog</a>.</li>
<li>For notes on the latest release of the <a
href="https://github.com/apache/arrow-dotnet";>.NET
implementation</a>, see the latest <a
href="https://github.com/apache/arrow-dotnet/releases";>Arrow .NET
changelog</a>.</li>
<li>For notes on the latest release of the <a
href="https://github.com/apache/arrow-swift";>Swift implementation</a>, see the
latest <a href="https://github.com/apache/arrow-swift/releases";>Arrow Swift
changelog</a>.</li>
-</ul>]]></content><author><name>pmc</name></author><category term="release"
/><summary type="html"><![CDATA[The Apache Arrow team is pleased to announce
the 26.0.0 release. This release covers over 3 months of development work and
includes 337 resolved issues on 403 distinct commits from 108 distinct
contributors. See the Install Page to learn how to get the libraries for your
platform. The release notes below are not exhaustive and only expose selected
highlights of the release. Many ot [...]
+</ul>]]></content><author><name>pmc</name></author><category term="release"
/><summary type="html"><![CDATA[The Apache Arrow team is pleased to announce
the 26.0.0 release. This release covers over 3 months of development work and
includes 337 resolved issues on 403 distinct commits from 108 distinct
contributors. See the Install Page to learn how to get the libraries for your
platform. The release notes below are not exhaustive and only expose selected
highlights of the release. Many ot [...]
-->
<p>The Apache Arrow team is pleased to announce that the v60.0.0 release of
Apache Arrow
diff --git a/release/index.html b/release/index.html
index 1de335ed9fe..d6cd137a147 100644
--- a/release/index.html
+++ b/release/index.html
@@ -20,13 +20,13 @@
<meta property="og:site_name" content="Apache Arrow" />
<meta property="og:image"
content="https://arrow.apache.org/img/arrow-logo_horizontal_black-txt_white-bg.png";
/>
<meta property="og:type" content="article" />
-<meta property="article:published_time" content="2026-10-20T12:58:07-04:00" />
-<meta property="article:modified_time" content="2026-10-20T12:58:07-04:00" />
+<meta property="article:published_time" content="2026-10-20T14:19:27-04:00" />
+<meta property="article:modified_time" content="2026-10-20T14:19:27-04:00" />
<meta name="twitter:card" content="summary_large_image" />
<meta name="twitter:image"
content="https://arrow.apache.org/img/arrow-logo_horizontal_black-txt_white-bg.png";
/>
<meta name="twitter:title" content="Releases" />
<script type="application/ld+json">
-{"@context":"https://schema.org","@type":"BlogPosting","dateModified":"2026-10-20T12:58:07-04:00","datePublished":"2026-10-20T12:58:07-04:00","description":"Apache
Arrow Releases Navigate to the release page for downloads and the changelog.
26.0.0 (9 October 2026) 25.0.1 (10 August 2026) 25.0.0 (10 July 2026) 24.0.0
(21 April 2026) 23.0.1 (16 February 2026) 23.0.0 (18 January 2026) 22.0.0 (24
October 2025) 21.0.0 (17 July 2025) 20.0.0 (27 April 2025) 19.0.1 (16 February
2025) 19.0.0 (16 [...]
+{"@context":"https://schema.org","@type":"BlogPosting","dateModified":"2026-10-20T14:19:27-04:00","datePublished":"2026-10-20T14:19:27-04:00","description":"Apache
Arrow Releases Navigate to the release page for downloads and the changelog.
26.0.0 (9 October 2026) 25.0.1 (10 August 2026) 25.0.0 (10 July 2026) 24.0.0
(21 April 2026) 23.0.1 (16 February 2026) 23.0.0 (18 January 2026) 22.0.0 (24
October 2025) 21.0.0 (17 July 2025) 20.0.0 (27 April 2025) 19.0.1 (16 February
2025) 19.0.0 (16 [...]
<!-- End Jekyll SEO tag -->
![https://arrow.apache.org/img/arrow-logo_horizontal_black-txt_white-bg.png"](https://arrow.apache.org/img/arrow-logo_horizontal_black-txt_white-bg.png"){kind=link}