Add warning for pyarrow<14.0.1 usage

[fjetter]

Pyarrow has a vulnerability to arbitrary code execution embedded in parquet, feather or arrow IPC. Dask users are potentially affected by this through our parquet reader.

The hotfix package raises if the read file has the potential to be harmful which is not ideal but I believe this is still the best approach for most users.
We can install this package whenever somebody installs dask[complete] (we should do the same for our conda package) and raise appropriate warnings.
Increasing the minimal version to 14.0.1 was also brought up in another context for P2P shuffling so going through this deprecation cycle is beneficial for us either way.

Context

• https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n
• https://www.cve.org/CVERecord?id=CVE-2023-47248

[fjetter]

Builds are failing because I'm raising this warning... At least we got confirmation that works :)

I'll add this warning to the ignore list

(BTW this will trigger as soon as people import dask.dataframe)

[hendrikmakait]

It looks like we still need to ignore UserWarning: You are using pyarrow version 9.0.0 which is known to be insecure. See https://www.cve.org/CVERecord?id=CVE-2023-47248 for further details. Please upgrade to pyarrow>=14.0.1 or install pyarrow-hotfix to patch your current version..

[jrbourbeau]

Thanks for handling this @fjetter. A couple of thoughts:

• Having the warning at the import dask.dataframe as dd level seems a little heavy handed. IIRC we only use pyarrow in a few place (i.e. Parquet / ORC / engine="pyarrow" in read_csv and auto-inferring pyarrow strings). Can we just emit this warning in those cases?
• Does adding pyarrow-hotfix as a core dask dependency have any downside? It's a small, pure Python package with no dependencies (not even pyarrow). That would ensure that no matter what, if you're using a new version of Dask, you're not impacted by the issue.

Also cc @rjzamora for visibility

[fjetter]

Can we just emit this warning in those cases?

I don't feel like this is worth the effort and considering this is a security risk, I'm fine with being a little noisy. It's very easy for people to avoid this by upgrading.

That would ensure that no matter what, if you're using a new version of Dask, you're not impacted by the issue.

See above

The hotfix package raises if the read file has the potential to be harmful which is not ideal but I believe this is still the best approach for most users.

beyond this, this shouldn't have any implications