[FLINK-40599] Allow pyarrow up to 25.x (CVE-2026-25087)

[florianvazelle]

What is the purpose of the change

Raise PyFlink's pyarrow upper bound from <21.0.0 to <26.0.0 so Python 3.10+ environments can install pyarrow 25.x.

That also unblocks installing Arrow C++ 23.0.1+, which is the fix for CVE-2026-25087 (use-after-free in Arrow C++ 15.0.0–23.0.0 when reading an IPC file with pre-buffering). The previous <21 cap made a patched pyarrow uninstallable. This change does not raise the lower bound, so older pyarrow versions can still be resolved.

Arrow Java is left at 19.0.0.

Python 3.9 remains supported by Flink. pyarrow 22 dropped 3.9 wheels, so pip on 3.9 will keep resolving a 21.x wheel inside the new range.

Brief change log

• Raise pyarrow from >=5.0.0,<21.0.0 to >=5.0.0,<26.0.0 in flink-python/setup.py and flink-python/pyproject.toml
• Document in flink-python/pom.xml that Arrow Java is not version-aligned with pyarrow (still 19.0.0)

Verifying this change

This change is already covered by existing tests, such as:

• pyflink.table.tests.test_types.ArrowTypeConversionTests (Arrow ↔ Flink type mapping)
• pandas UDF / UDAF tests (test_pandas_udaf, vectorized operations)
• Table.to_pandas / Arrow serializer tests (test_table_environment_api)
• DataFrame Arrow conversion tests (pyflink.dataframe.tests.test_convert)

CI should install pyarrow 25.x on Python 3.10+ and a 21.x wheel on Python 3.9.

Does this pull request potentially affect one of the following parts:

• Dependencies (does it add or upgrade a dependency): yes (raises the pyarrow upper bound; Arrow Java unchanged)
• The public API, i.e., is any changed class annotated with @Public(Evolving): no
• The serializers: no
• The runtime per-record code paths (performance sensitive): no
• Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no
• The S3 file system connector: no

Documentation

• Does this pull request introduce a new feature? no
• If yes, how is the feature documented? not applicable

[flinkbot]

CI report:

• 7e71ea0 Azure: SUCCESS

Bot commands

The @flinkbot bot supports the following commands:

• @flinkbot run azure re-run the last Azure build

[dianfu]

@florianvazelle Thanks for the PR. LGTM.