build(deps): bump pyarrow from 24.0.0 to 25.0.0

[dependabot]

Bumps pyarrow from 24.0.0 to 25.0.0.

Release notes

Sourced from pyarrow's releases.

Apache Arrow 25.0.0

Release Notes URL: https://arrow.apache.org/release/25.0.0.html

Apache Arrow 25.0.0 RC1

Release Notes: Release Candidate: 25.0.0 RC1

Commits

• 59bea6e MINOR: [Release] Update versions for 25.0.0
• 381fab6 MINOR: [Release] Update .deb/.rpm changelogs for 25.0.0
• 7f72d5b MINOR: [Release] Update CHANGELOG.md for 25.0.0
• fe2f85c GH-50336: [Release][Archery] Fix archery GitHub integration for release scrip...
• c658548 GH-50293: [CI] Run check-labels for all triggers to avoid cancelling further ...
• f83c8ca GH-50330: [C++][R][Parquet] Add missing typename in RleBitPackedDecoderGetRun...
• 35e0f63 GH-50318: [R][CI] Install missing libpng-dev for test-r-linux-as-cran (#50328)
• 61ca7a9 GH-50295: [C++][R] #include <ranges> in vector_select_k.cc breaks macOS CRAN ...
• 1b6edb8 GH-50291: [Python][Packaging] Stop using nightly build dependencies for build...
• e183ea9 MINOR: [Docs] Add Timestamp With Offset to canonical extension types status (...
• Additional commits viewable in compare view

[gcalpay]

Requesting changes before this dependency update is merged.

I reviewed the PR diff, the current Verify/CodeQL/dependency-audit results, the strict-mypy failures, and the relevant Apache Arrow 25.0.0 typing notes.

1. Do not raise the declared minimum PyArrow version without a compatibility reason

This PR changes Carnopy's public runtime requirement from pyarrow>=16 to pyarrow>=25.0.0, in addition to resolving the lockfile from PyArrow 24.0.0 to 25.0.0. The existing >=16 constraint already permits installation of PyArrow 25. Raising the lower bound therefore contracts Carnopy's declared compatibility range and should only be done if Carnopy actually requires an API/behavior introduced after PyArrow 16. I found no such justification in this dependency-only PR.

Please preserve the existing lower bound unless a source-level compatibility review demonstrates that older supported PyArrow versions must be dropped.

2. The PR currently fails Carnopy's strict type checks

Runtime tests pass on Python 3.11, 3.12, 3.13 and 3.14, and the installed QML smoke tests pass on Windows, Ubuntu and macOS. Dependency review, dependency audit and CodeQL also pass. However, Verify is red because both strict-mypy jobs fail:

• src/carnopy/inspection.py:503: unused type: ignore[no-untyped-call]
• src/carnopy/app/table_preview.py:49: unused type: ignore[no-untyped-call]
• src/carnopy/app/table_preview.py:66: unused type: ignore[no-untyped-call]

These should not simply be interpreted as "PyArrow 25 has better typing". Apache Arrow 25.0.0 explicitly notes that Python annotations are being withheld from wheels until they are complete, following upstream type-checker problems with the incomplete PyArrow stubs (apache/arrow#49831). That upstream change can make existing suppressions become unused while simultaneously reducing what mypy can check.

Relevant upstream context:

• https://arrow.apache.org/blog/2026/07/10/25.0.0-release/
• apache/arrow#49831

Before merging, please choose an intentional typing strategy rather than deleting suppressions solely to make CI green. In particular, verify how the chosen fix behaves across Carnopy's declared PyArrow support range and rerun the full strict-mypy and test suites.

Recommendation

The PyArrow 25 runtime update itself looks promising from the passing test matrix, but this PR should not be merged as-is. First resolve the typing regression/behavior intentionally, decide whether the >=16 compatibility floor remains valid, and get Verify fully green.