chore(deps): bump pyarrow from 21.0.0 to 23.0.1 in /scripts/perf/evidence/server-pgo-darwin-2026-09-07/reproduce

[dependabot]

Bumps pyarrow from 21.0.0 to 23.0.1.

Release notes

Sourced from pyarrow's releases.

Apache Arrow 23.0.1

Release Notes URL: https://arrow.apache.org/release/23.0.1.html

Apache Arrow 23.0.1 RC0

Release Notes: Release Candidate: 23.0.1 RC0

Apache Arrow 23.0.0

Release Notes URL: https://arrow.apache.org/release/23.0.0.html

Apache Arrow 23.0.0 RC2

Release Notes: Release Candidate: 23.0.0 RC2

Apache Arrow 22.0.0

Release Notes URL: https://arrow.apache.org/release/22.0.0.html

Apache Arrow 22.0.0 RC1

Release Notes: Release Candidate: 22.0.0 RC1

Apache Arrow 22.0.0 RC0

Release Notes: Release Candidate: 22.0.0 RC0

Commits

• 82a374e MINOR: [Release] Update versions for 23.0.1
• c1ae37c MINOR: [Release] Update .deb/.rpm changelogs for 23.0.1
• 8f6e557 MINOR: [Release] Update CHANGELOG.md for 23.0.1
• 4e16a1a GH-49159: [C++][Gandiva] Detect overflow in repeat() (#49160)
• 985621d GH-48817 [R][C++] Bump C++20 in R build infrastructure (#48819)
• 1bea06a GH-49024: [CI] Update Debian version in .env (#49032)
• 147bcd6 GH-49156: [Python] Require GIL for string comparison (#49161)
• e4f922b GH-49138: [Packaging][Python] Remove nightly cython install from manylinux wh...
• f9376e4 GH-49003: [C++] Don't consider out_of_range an error in float parsing (#49095)
• ab2c0ad GH-49044: [CI][Python] Fix test_download_tzdata_on_windows by adding required...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated
ifc-lite-dev	Ignored		Sep 7, 2026 2:50am UTC
ifc-lite-viewer-embed	Ignored		Sep 7, 2026 2:50am UTC

[BIMvoice]

Reviewed — safe to merge, verified by running the code rather than reading the changelog.

The 21 → 23 jump looked like it warranted scrutiny, so I checked what actually breaks. Arrow 22 removed the deprecated string-based Parquet encryption methods and dropped Python 3.9; Arrow 23 removed Array.format and adjusted pandas-3.0 datetime-unit compatibility. None apply here — this code does no Parquet encryption, imports no pandas, and never calls Array.format.

The APIs it does use are all long-standing: parquet.read_table/write_table/ParquetFile/iter_batches, Table.from_pylist/slice/take/select/cast/append_column, pa.schema, pa.concat_tables, pa.chunked_array, Array.from_buffers, chunk.buffers(), to_numpy(zero_copy_only=True), the pa.types.is_* predicates, pyarrow.compute.is_finite/all/min/max, and pa.BufferReader.

Ran the bundled tests in a fresh venv with pyarrow==23.0.1 against the actual files from this branch:

Ran 10 tests in 1.763s
OK

Two other things worth noting:

• The changed file is scripts/perf/evidence/server-pgo-darwin-2026-09-07/reproduce/requirements.txt — a pin inside a dated, one-off performance-evidence bundle. git grep confirms no workflow installs it, so the blast radius is that reproduction script only.
• It does not overlap fix(ci): install Python toolchain for revert-oracle's pytest lane #4102's install path. tools/ifcopenshell_reference/requirements.lock pins only ifcopenshell, numpy and shapely — no pyarrow or requests — so this cannot disturb the revert-oracle Python lane that fix(review): let the revert-oracle see Python tests instead of reporting UNOBSERVED #4079 made live.

The two red checks are Claude review and Review posted, both from one infra cause — AUTH_MISSING: CLAUDE_CODE_OAUTH_TOKEN is unset or empty — with Review posted failing downstream because the review job never ran. Every other check passes. That token is unset repo-wide and is worth restoring separately; it is not a signal about this PR.

[louistrue]

Closing, and this is a category error rather than a judgement call about the version.

scripts/perf/evidence/server-pgo-darwin-2026-09-07/reproduce/requirements.txt is not a dependency manifest for anything that runs. It is part of a preserved evidence archive for a rejected experiment, titled "Actual Darwin server PGO: both screens rejected". Its own README says what the directory is:

reproduce/ contains the actual HTTP transport, full wire/data-model witnesses, tests and paired driver, plus parameterized build/training/profile tools. These are manual evidence tools, not production entry points or CI performance gates.

The pinned versions are part of the measurement. The archive exists so that a specific result, produced on a specific day with specific tooling, can be reproduced and checked. Bumping the pins does not make anything safer; it makes the reproduction no longer a reproduction. The recorded provenance (pre-screen-provenance.json, harness-source-map.json, compiled-source hash maps) is the point of the directory, and a dependency bump silently invalidates it.

There is no exposure to fix here either: nothing in scripts/perf/evidence/ is imported by production code, shipped in a package, or run in CI. It is read by humans checking a claim.

The real fix is that dependabot should not scan this tree at all, so this does not recur every time a transitive pin moves. Filing that separately.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.