chore: Update DuckDB and ignore pyarrow finding

Author: m1so

.github/workflows/ci.yml

@@ -472,10 +472,15 @@ jobs:
           # * false positive: only affects Arrow R package, not PyArrow
           # * see CVE description: "This vulnerability only affects the arrow R package, not other Apache Arrow implementations"
           # * databricks-sqlalchemy 1.x caps pyarrow<17, but upgrading requires SQLAlchemy 2.x (which is not possible for some Python versions)
+          # PYSEC-2026-113 (Arrow C++ IPC file pre-buffering use-after-free)
+          # * false positive for Python: advisory says RecordBatchFileReader::PreBufferMetadata is not exposed in Python bindings
+          # * this repo uses PyArrow through pandas parquet IO and Arrow table construction, not IPC file pre-buffering
+          # * databricks-sqlalchemy 1.x caps pyarrow<17, but upgrading requires SQLAlchemy 2.x (which is not possible for some Python versions)
           ignore-vulns: &ignore-vulns |
             PYSEC-2023-121
             CVE-2026-0994
             PYSEC-2024-161
+            PYSEC-2026-113
 
   audit-all:
     name: Audit - All

poetry.lock

@@ -54,12 +54,13 @@ dependencies = [
     "numpy>=2.1.0,<3; python_version >= '3.13'",
 
     # SQL and database dependencies
-    "duckdb>=1.1.0,<2.0.0; python_version < '3.12'",
-    "duckdb>=1.1.0,<2.0.0; python_version >= '3.12'",
-    "duckdb>=1.4.1,<2.0.0; python_version >= '3.13'",
-    "duckdb-extensions>=1.1.0,<2.0.0", # bake in as dependency to not pull extensions from the internet on every notebook start
-    "duckdb-extension-spatial>=1.1.0,<2.0.0",
-    "duckdb-extension-excel>=1.1.0,<2.0.0",
+    # Keep DuckDB on the 1.4 LTS line until its EOL on 2026-09-16.
+    "duckdb>=1.4.2,<1.5.0; python_version < '3.12'",
+    "duckdb>=1.4.2,<1.5.0; python_version >= '3.12'",
+    "duckdb>=1.4.2,<1.5.0; python_version >= '3.13'",
+    "duckdb-extensions>=1.4.2,<1.5.0", # bake in as dependency to not pull extensions from the internet on every notebook start
+    "duckdb-extension-spatial>=1.4.2,<1.5.0",
+    "duckdb-extension-excel>=1.4.2,<1.5.0",
     "google-cloud-bigquery-storage>=2.33.1,<3",
 
     "pyarrow>=10.0.0,<=17.0.0; python_version == '3.10' and sys_platform != 'darwin'",