This has also happened previously, see #2922

Hi @jtroup

Thank you for your interest in improving our advisory database. This vulnerability appears to only affect the Arrow R package, which is not in our supported ecosystems. The advisory explicitly states that only the R package is affected, and the section you quote reinforces this point by stating PyArrow is only affected if used via the R package.

For PyArrow to be considered affected in our database, we would need evidence that the vulnerability exists in PyArrow's own codebase or that PyArrow users face risk when using PyArrow independently (not through the R package).

In addition, the fix commit shows that all of the changes are in the R package, whereas in the previous #2922 example, all of the changes were in the PyArrow package.

Do you have any additional information that would show the PyArrow package is independently affected?